CVE-2025-4855
Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.
Reserved 2025-05-16 | Published 2025-07-08 | Updated 2025-07-09 | Assigner WordfenceCWE-639 Authorization Bypass Through User-Controlled Key
| 2025-05-15: | Discovered |
| 2025-07-07: | Vendor Notified |
| 2025-07-08: | Disclosed |
Friderika Baranyai
www.wordfence.com/...-d490-4a3e-97fc-70cf008cbf66?source=cve
codecanyon.net/.../support-board-help-desk-and-chat/20359943
Support options
