PT-2025-28804 · WordPress · Support Board

Friderika Baranyai · Published 2025-07-08 · Updated 2026-04-08 · CVE-2025-4855

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: The Support Board plugin for WordPress versions up to, and including, 3.8.0

Description: The issue allows unauthorized access, modification, or deletion of data due to the use of hardcoded default secrets in the sb encryption() function. This enables unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb ajax execute() function.

Recommendations: For versions up to, and including, 3.8.0, update to a version that fixes the hardcoded default secrets issue in the sb encryption() function to prevent unauthorized access and arbitrary AJAX action execution. As a temporary workaround, consider restricting access to the sb ajax execute() function until a patch is available.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-4855

Affected Products

Support Board

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-4855 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4855 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/afd48bc8-d490-4a3e-97fc-70cf008cbf66?source=cve · Note
• https://t.me/cvenotify/128109 · Telegram Post
• https://twitter.com/0dayPublishing/status/2041937631466913855 · Twitter Post
• https://twitter.com/cracbot/status/1944713526117032196 · Twitter Post
• https://codecanyon.net/item/support-board-help-desk-and-chat/20359943 · Note
• https://twitter.com/0dayPublishing/status/2041948472027308274 · Twitter Post
• https://t.me/cvenotify/128108 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1942847120366535107 · Twitter Post
• https://twitter.com/CVEnew/status/1942924487793803769 · Twitter Post