Read the docs
TI-2025-04348 Aliases CVE-2025-4855GHSA-vv4w-9vmx-jmwp

Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key

Priority MEDIUM 49CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SchioccoSupport Boardup to 3.8.0—No fix listedCNA
  • Support Board VendorSchiocco Affected up to 3.8.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:schiocco:support_board:*:*:*:*:*:wordpress:*:*before 3.8.1VulnerableSchiocco
  • cpe:2.3:a:schiocco:support_board:*:*:*:*:*:wordpress:*:* Versions before 3.8.1 Vulnerable ·Schiocco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4855
  2. 2026-10-03 Alias added: GHSA-vv4w-9vmx-jmwp

References

Advisory 1

Other 1

  • TI-2025-04323 Support Board <= 3.8.0 - Unauthenticated Arbitrary File Deletion CVSS 3.1CRITICAL 9.8
  • TI-2026-04199 SQL Injection vulnerability in Support Board CVSS 4.0HIGH 8.7
  • TI-2021-07105 Support Board < 3.3.6 - Arbitrary File Deletion via CSRF CVSS 3.1HIGH 8.1
  • TI-2021-07089 Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.4
  • TI-2026-04200 Reflected Cross Site Scripting (XSS) vulnerability in Support Board CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences