A critical hardcoded secret vulnerability in the Support Board plugin for WordPress allows unauthenticated attackers to bypass security controls and manipulate sensitive data.

The plugin utilizes hardcoded default secrets within the sb_encryption() function. This enables attackers to decrypt or forge encrypted data, leading to unauthorized access, modification, or deletion of stored information.

This vulnerability is rated at 9.8, reflecting its critical nature. Exploitation allows an attacker to gain unauthorized access to support communications, customer data, and system configurations, potentially leading to a complete breach of confidentiality and integrity within the WordPress environment.

Immediate Action: Update the Support Board plugin to the latest available version provided by the vendor to remediate the hardcoded encryption secrets.

Proactive Monitoring: Review database access logs and WordPress audit logs for anomalous data modification patterns or unauthorized administrative actions.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious requests targeting plugin-specific endpoints and ensure that sensitive database entries are encrypted with enterprise-managed keys where possible.

Public Exploit Available: Unknown

The reliance on hardcoded secrets constitutes a fundamental security flaw that must be addressed immediately. Administrators should update the plugin as soon as a patch is available and conduct a thorough audit of any data that may have been exposed while the plugin was in a vulnerable state.