CVE-2024-27956
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
- Published
- Mar 21, 2024
- Updated
- Apr 28, 2026
- Assigning CNA
- Patchstack
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:LHigh · next 30 days
- Percentile
- 99.8%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.
Sources
modules/exploits/multi/http/wp_automatic_sqli_to_rce.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,PHP,Unix,Windows($.exploit_multi/http/wp_automatic_sqli_to_rce.platform)
- verification: check_declared($.exploit_multi/http/wp_automatic_sqli_to_rce.check)
http/cves/2024/CVE-2024-27956.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)
Yaml PoC rule for fscan.
- CVE-2024-27956Exploit
Perform with massive Wordpress SQLI 2 RCE
- CVE-2024-27956Scanner
WordPress Automatic Plugin <= 3.92.0 - SQL Injection
- EXPLOITING-CVE-2024-27956Exploit
Python exploit for CVE-2024-27956, a WordPress SQL injection vulnerability that enables remote code execution, allowing attackers to execute arbitrary commands on the target server.
Proof-of-concept exploit for CVE-2024-27956, a SQL injection in ValvePress Automatic WordPress plugin. Creates admin user and enables remote code execution via unsanitized input.
- CVE-2024-27956Exploit
CVE-2024-27956 - WP Automatic SQL Injection Exploit Tool
PoC for SQL Injection in CVE-2024-27956
- MASS-CVE-2024-27956Exploit
Proof-of-concept exploit for CVE-2024-27956 SQL injection in ValvePress Automatic plugin. Creates admin users in WordPress to achieve remote code execution.
CVE-2024-27956 WordPress Automatic < 3.92.1 - Unauthenticated SQL Injection
Python proof-of-concept targeting CVE-2024-27956, designed to demonstrate and verify exploitation of the underlying vulnerability.
- CVE-2024-27956Exploit
Proof-of-concept exploit for CVE-2024-27956: SQL injection in WordPress leading to admin account creation and remote code execution. Written in Python.
Valve Press - CVE-2024-27956-RCE - SQL Injection
- wordpress-CVE-2024-27956Exploit
Automates SQL injection in WordPress wp-automatic plugin to create a new administrator user, exploiting CVE-2024-27956 for direct database manipulation.
Exploit scripts and scanner for CVE-2024-27956, a WordPress plugin vulnerability, including a modified exploit with SSL verification bypass.
CVE-2024-27956 WORDPRESS RCE PLUGIN
CVE-2024-27956
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.