CVE-2024-27954

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Request Forgery.This issue affects Automatic: from n/a through 3.92.0.

CVSS v3.1

9.3 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

EPSS

72.95% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-918

Published

2024-05-17

Updated

2026-04-28

Proof-of-concept exploits (5)

• AlienTec1908/Matrioshka_HackMyVM_Medium1★ · 2025-12-08
• Quantum-Hacker/CVE-2024-279541★ · 2026-08-25
• fa-rrel/CVE-2024-279544★ · 2024-10-29
• gh-ost00/CVE-2024-279544★ · 2024-10-29
• r0otk3r/CVE-2024-279540★ · 2025-07-12

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27954.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2024-27956
• CVE-2024-39943
• CVE-2024-27564
• CVE-2024-2876
• CVE-2024-29269
• CVE-2023-7028