CVE-2025-4855

Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key

Description

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.

Category

9.8
CVSS
Severity: Critical
CVSS 3.1 •
EPSS 0.08%
Affected: Schiocco Support Board
Published at:
Updated at:

References

Link Tags
https://www.wordfence.com/threat-intel/vulnerabilities/id/afd48bc8-d490-4a3e-97fc-70cf008cbf66?source=cve
https://codecanyon.net/item/support-board-help-desk-and-chat/20359943

Frequently Asked Questions

What is the severity of CVE-2025-4855?
CVE-2025-4855 has been scored as a critical severity vulnerability.
How to fix CVE-2025-4855?
To fix CVE-2025-4855, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-4855 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-4855 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-4855?
CVE-2025-4855 affects Schiocco Support Board.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.