CVE-2024-27954
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability
CRITICAL 9.3EPSS 72.8%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Request Forgery.This issue affects Automatic: from n/a through 3.92.0.
- Affected
- WP Automatic · Automatic
- CVSS v3.1 PATCHSTACK
- 9.3 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - EPSS
- 72.77% chance of exploitation in the next 30 days, 99th percentile
- Nuclei
- critical · CWE-918
- Published
- 2024-05-17
- Updated
- 2026-04-28
Proof-of-concept exploits (4)
- AlienTec1908/Matrioshka_HackMyVM_Medium1★ · 2025-12-08
- fa-rrel/CVE-2024-279544★ · 2024-10-29
- gh-ost00/CVE-2024-279544★ · 2024-10-29
- r0otk3r/CVE-2024-279540★ · 2025-07-12