KEVIntel
Back to KEVs
9.3
CVSS
Critical

CVE-2024-27954

PUBLISHED

WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability

Exploited in the wild PoC available Remote Low complexity No user interaction
Vendor
WP Automatic
Product
Automatic
Published
May 17, 2024
EPSS
—

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Request Forgery.This issue affects Automatic: from n/a through 3.92.0.

wordpress nuclei_scanner

CVSS scores

CVSS v3.1 9.3 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Exploitation status

Exploited in the wild

Recorded 2025-04-22 00:00:00 UTC · Source

Proof of concept available

Recorded 2024-10-29 00:46:35 UTC · Source

SSVC decision points

Exploitation
poc
Automatable
Yes
Technical impact
partial

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
The Shadowserver (via CIRCL) Apr 24, 2025

Scanner integrations

Scanner Reference Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27954.yaml Apr 25, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

gh-ost00/CVE-2024-27954

github · Created 2024-10-29 00:46:35 UTC · 4 stars

Automatic Plugin for WordPress < 3.92.1 Multiples Vulnerabilities

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Proof of Concept Exploit Available

  • Added to KEVIntel

  • Detected by Nuclei