CVE-2025-4855 is an authorization bypass vulnerability in the Support Board WordPress plugin caused by the use of hardcoded default secrets in the sb_encryption() function in all versions up to 3.8.0. This weakness enables unauthenticated attackers to bypass authorization checks and execute arbitrary AJAX actions defined in sb_ajax_execute(), including exploiting CVE-2025-4828 and other functions without authentication. The vulnerability is remotely exploitable over the network without user interaction and has a critical impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to bypass authorization mechanisms, leading to full compromise of the affected plugin's functionality. This can result in unauthorized access to sensitive data, modification or deletion of data, and execution of arbitrary actions within the plugin context. The vulnerability affects all versions up to and including 3.8.0 of the Support Board plugin. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Support Board plugin to mitigate risk. Monitor the vendor's communications for updates on patches or temporary mitigations.