Every CVE Search/ Get API key

CVE-2024-27956

WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

9.9 CriticalPublic exploit

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
Low

Exploit likelihood

94.1%Up 94.0 points since Mar 22, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.9

WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

Record
CVE-2024-27956
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2024-25130 9.9

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

Record
EUVD-2024-25130
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-xv4r-44qp-78wm 9.9

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

Record
GHSA-xv4r-44qp-78wm
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
Weakness
CWE-89
Updated
2026-11-02
NVD 9.9

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

Record
CVE-2024-27956
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitWordPress wp-automatic Plugin SQLi Admin Creation2024-03-13
NucleiWordPress Automatic Plugin <= 3.92.0 - SQL Injection
PoC in GitHub0axz-tools/CVE-2024-279562025-10-17
PoC in GitHub7aRanchi/CVE-2024-27956-for-fscan2024-12-20
PoC in GitHubAp0dexMe0/CVE-2024-279562024-07-11
PoC in GitHubCERTologists/EXPLOITING-CVE-2024-279562024-07-23
PoC in GitHubCappricio-Securities/CVE-2024-279562024-06-07
PoC in GitHubFoxyProxys/CVE-2024-279562024-05-05
PoC in GitHubW3BW/CVE-2024-27956-RCE-File-Package2024-05-15
PoC in GitHubX-Projetion/CVE-2024-27956-WORDPRESS-RCE-PLUGIN2024-05-03
Show 8 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubcve-2024/CVE-2024-27956-RCE2024-06-14
PoC in GitHubdevsec23/CVE-2024-279562025-05-01
PoC in GitHubdiego-tella/CVE-2024-27956-RCE2024-05-01
PoC in GitHubhitazuranahiro/Valve-Press-CVE-2024-27956-RCE2024-06-13
PoC in GitHubitzheartzz/MASS-CVE-2024-279562024-06-09
PoC in GitHubk3ppf0r/CVE-2024-279562024-05-07
PoC in GitHubm4nInTh3mIdDle/wordpress-CVE-2024-279562025-04-27
PoC in GitHubtruonghuuphuc/CVE-2024-279562024-04-27

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-27956 is a critical vulnerability (CVSS 9.9) in Valvepress Automatic, published March 21, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 94.1%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open