CVE-2024-27956

—1

CVSS 3.1

9.8 critical

EPSS

94%p100

Published

Mar 21, 2024 (Mar 21, 2024)

Modified

Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

Vendors: valvepress
Products: automatic
Ecosystems: WordPress
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (94.0%)

In the news5 stories

Hackers Exploit WordPress mu-Plugins to Inject Spam and Hijack Site Images

The Hacker NewsApr 1, 05:37 UTC · Apr 1, 2025Data breach CVE-2024-27956 CVE-2024-8353 CVE-2024-4345

Hackers Exploiting WP-Automatic Plugin Bug to Create Admin Accounts on WordPress Sites

The Hacker NewsApr 27, 04:59 UTC · Apr 27, 2024Vulnerability CVE-2024-27956 CVE-2024-2876 CVE-2024-28890+2 CVEs1

Experts warn of malware campaign targeting WP

Security AffairsApr 26, 13:40 UTC · Apr 26, 2024Malware CVE-2024-279561

ShadowSilk Hits 35 Organizations in Central Asia and APAC Using Telegram Bots

The Hacker NewsAug 28, 03:59 UTC · Aug 28, 2025Exploit / PoC CVE-2018-7600 CVE-2018-76020 CVE-2024-27956

Hackers try to exploit WordPress plugin vulnerability that’s as severe as it gets

Ars Technica · SecurityApr 26, 19:07 UTC · Apr 26, 2024Vulnerability CVE-2024-27956 CVE-2024-27596