Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key
Vulnerability Description
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-4855
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Friderika Baranyai
References
More from Schiocco
View All →Affected Vendor
Schiocco
View all reports →