CVE-2026-110372
9.8CriticalPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-266
Impact
Unauthenticated remote attackers can escalate privileges to take full administrative control of the WordPress site. They do not need existing credentials or user interaction.
Root cause
The OttoKit (suretriggers) plugin assigns privileges incorrectly, exposing elevated permissions to unauthorized users.
Affected systems
Brainstorm Force OttoKit (suretriggers) plugin through version 1.1.40
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade OttoKit (suretriggers) to a version newer than 1.1.40, or deactivate and delete the plugin immediately if an update is not yet available.
$ wp plugin update suretriggersAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.