Hackers have begun exploiting a critical authentication bypass vulnerability in the OttoKit WordPress plugin just hours after its public disclosure. Users are urged to upgrade to version 1.0.79 to prevent unauthorized access, as attackers can create new admin accounts without authentication. Swift action is necessary to mitigate the risk of full site takeover following the flaw's identification as CVE-2025-3102.