The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion

链接： https://github.com/advisories/GHSA-vv4w-9vmx-jmwp

CVSS 评分： 9.8

参考链接：

• https://nvd.nist.gov/vuln/detail/CVE-2025-4855

• https://codecanyon.net/item/support-board-help-desk-and-chat/20359943

• https://www.wordfence.com/threat-intel/vulnerabilities/id/afd48bc8-d490-4a3e-97fc-70cf008cbf66?source=cve

• https://github.com/advisories/GHSA-vv4w-9vmx-jmwp

描述：

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.