CVE-2024-27956criticalobserved exploitationCWE-89

CVE-2024-27956: critical vulnerability in ValvePress Automatic

WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

Published · Updated

100Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.9epss 94%
from disclosure to weapon37 days
Published on NVDMar 21
1st PoC+37d
metasploitMar 13
VulnCheck+34d
exploitation probability
94%top 1% of all CVEs
observed exploitation
yesVulnCheck
31 public exploit(s)
In short

The WordPress Automatic plugin allows attackers to execute arbitrary SQL commands without needing to log in, potentially exposing or modifying sensitive database information. This happens because the plugin does not properly validate user input before using it in database queries.

Technical detail

CWE-89 SQL Injection vulnerability in Automatic plugin versions up to 3.92.0 allows unauthenticated attackers to inject malicious SQL commands through inadequately sanitized input parameters. Successful exploitation enables unauthorized database access, data exfiltration, or modification without requiring valid credentials.

Summary generated and translated by AI from the official description.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
Affected products
ValvePress · Automatic
public PoCs found — 31
githubgithub.com/diego-tella/CVE-2024-27956-RCE★ 90githubgithub.com/Ap0dexMe0/CVE-2024-27956★ 8githubgithub.com/itzheartzz/MASS-CVE-2024-27956★ 3githubgithub.com/Cappricio-Securities/CVE-2024-27956★ 2githubgithub.com/truonghuuphuc/CVE-2024-27956★ 2githubgithub.com/FoxyProxys/CVE-2024-27956★ 1githubgithub.com/devsec23/CVE-2024-27956★ 1githubgithub.com/7aRanchi/CVE-2024-27956-for-fscan★ 0githubgithub.com/m4nInTh3mIdDle/wordpress-CVE-2024-27956★ 0githubgithub.com/0axz-tools/CVE-2024-27956★ 0githubgithub.com/X-Projetion/CVE-2024-27956-WORDPRESS-RCE-PLUGIN★ 0githubgithub.com/k3ppf0r/CVE-2024-27956★ 0githubgithub.com/W3BW/CVE-2024-27956-RCE-File-Package★ 0githubgithub.com/hitazuranahiro/Valve-Press-CVE-2024-27956-RCE★ 0githubgithub.com/cve-2024/CVE-2024-27956-RCE★ 0githubgithub.com/CERTologists/EXPLOITING-CVE-2024-27956★ 0vulncheckvulncheck.com/xdb/68f086605e61unverifiedvulncheckvulncheck.com/xdb/23332f12d7daunverifiedvulncheckvulncheck.com/xdb/6141dc1c2fd0unverifiedvulncheckvulncheck.com/xdb/c213e3cf0599unverifiedvulncheckvulncheck.com/xdb/96f8fb6c286eunverifiedvulncheckvulncheck.com/xdb/47fdf7489fbfunverifiedvulncheckvulncheck.com/xdb/ee5ad81bbd31unverifiedvulncheckvulncheck.com/xdb/00ceb5c17386unverifiedvulncheckvulncheck.com/xdb/f1969acd14dfunverifiedvulncheckvulncheck.com/xdb/c2bee21d4146unverifiedvulncheckvulncheck.com/xdb/541234df3b1aunverifiedvulncheckvulncheck.com/xdb/195cd4df2bdfunverifiedvulncheckvulncheck.com/xdb/e23e19a6e213unverifiedvulncheckvulncheck.com/xdb/799f8a79b8afunverifiedvulncheckvulncheck.com/xdb/ee7e0f0a304funverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ValvePress Automatic

In the same product, most dangerous first.

CVE-2026-56045HIGHWordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32693HIGHWordPress Automatic plugin < 3.93.0 - Multiple Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%
References
https://patchstack.com/articles/critical-vulnerabilities-patched-in-wordpress-automatic-plugin?_s_id=cvehttps://patchstack.com/database/vulnerability/wp-automatic/wordpress-automatic-plugin-3-92-0-unauthenticated-arbitrary-sql-execution-vulnerability?_s_id=cve