CVE-2024-27954 is a critical Path Traversal and Server-Side Request Forgery (SSRF) vulnerability affecting the WP Automatic Automatic plugin, versions up to and including 3.92.0. With a CVSS score of 9.3 (Critical), this vulnerability allows unauthenticated attackers to remotely download arbitrary files and potentially inject backdoors, leading to high confidentiality impact and low integrity impact. While not yet in CISA's KEV catalog, exploit intelligence indicates the availability of Nuclei templates for exploitation and active discussion within the cybersecurity community, with media coverage confirming its exploitation in the wild.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| WP Automatic | Automatic | >= n/a, <= 3.92.0CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.