CVE-2024-27956

CVSS 3.1: 9.8 critical
EPSS: 94%p100
Published: Mar 21, 2024 · Mar 21, 2024
Modified: Jun 17, 2026

Analyze CVE-2024-27956 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

Vendors: valvepress

Products: automatic

Ecosystems: WordPress

Weakness: CWE-89

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (94.0%)

In the news

5 stories

Hackers Exploit WordPress mu-Plugins to Inject Spam and Hijack Site Images

The Hacker NewsApr 1, 05:37 UTC · Apr 1, 2025Data breachCVE-2024-27956 CVE-2024-8353 CVE-2024-43452

Hackers Exploiting WP-Automatic Plugin Bug to Create Admin Accounts on WordPress Sites

The Hacker NewsApr 27, 04:59 UTC · Apr 27, 2024VulnerabilityCVE-2024-27956 CVE-2024-2876 CVE-2024-28890+23 · 1 read

Experts warn of malware campaign targeting WP

Security AffairsApr 26, 13:40 UTC · Apr 26, 2024MalwareCVE-2024-279563 · 1 read

ShadowSilk Hits 35 Organizations in Central Asia and APAC Using Telegram Bots

The Hacker NewsAug 28, 03:59 UTC · Aug 28, 2025Exploit / PoCCVE-2018-7600 CVE-2018-76020 CVE-2024-279563 · 1 read

Hackers try to exploit WordPress plugin vulnerability that’s as severe as it gets

Ars Technica · SecurityApr 26, 19:07 UTC · Apr 26, 2024VulnerabilityCVE-2024-27956 CVE-2024-275962 · 1 read