Plattform
wordpress
Komponente
wp-automatic
Behoben in
3.92.1
CVE-2024-27956 describes a SQL Injection vulnerability discovered in ValvePress Automatic, a WordPress plugin. This vulnerability allows attackers to inject malicious SQL code, potentially leading to unauthorized access and manipulation of the database. Versions of Automatic prior to 3.92.1 are affected, and a patch has been released to address the issue.
The SQL Injection vulnerability in ValvePress Automatic poses a significant risk to WordPress websites utilizing the plugin. An attacker could leverage this flaw to bypass authentication, retrieve sensitive information such as user credentials, customer data, or plugin configurations, and even modify or delete critical database records. Successful exploitation could lead to complete website compromise, data breaches, and denial of service. The potential impact is amplified if the database contains personally identifiable information (PII) or financial data, making it a high-priority concern for website administrators.
CVE-2024-27956 was publicly disclosed on March 21, 2024. As of this writing, there are no publicly available proof-of-concept exploits. The vulnerability's CRITICAL CVSS score suggests a high probability of exploitation if left unpatched. It is advisable to prioritize remediation to prevent potential attacks.
WordPress websites utilizing the ValvePress Automatic plugin are at risk. Specifically, sites running older versions of the plugin (≤3.92.0) and those with limited security monitoring or WAF protection are particularly vulnerable. Shared hosting environments where plugin updates are managed by the hosting provider should also be assessed for timely patching.
• wordpress / composer / npm:
grep -r "ValvePress Automatic" /var/www/html/wp-content/plugins/
wp plugin list | grep "ValvePress Automatic"• generic web:
curl -I https://yourwebsite.com/wp-content/plugins/automatic/• wordpress / composer / npm:
wp plugin status automaticdisclosure
Exploit-Status
EPSS
93.82% (100% Perzentil)
CVSS-Vektor
The primary mitigation for CVE-2024-27956 is to immediately upgrade ValvePress Automatic to version 3.92.1 or later. If upgrading is not feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to reduce the attack surface. While not a complete solution, implementing a Web Application Firewall (WAF) with SQL Injection protection rules can provide an additional layer of defense. Regularly review database access logs for suspicious activity and consider implementing stricter database user permissions to limit the impact of a potential breach.
Actualice el plugin WordPress Automatic a la última versión disponible. La versión más reciente incluye una solución para la vulnerabilidad de inyección SQL. Si no puede actualizar, considere deshabilitar el plugin hasta que pueda realizar la actualización.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2024-27956 is a critical SQL Injection vulnerability affecting ValvePress Automatic versions up to 3.92.0, allowing attackers to manipulate the database.
Yes, if you are using ValvePress Automatic version 3.92.0 or earlier, you are vulnerable to this SQL Injection flaw.
Upgrade ValvePress Automatic to version 3.92.1 or later to resolve the SQL Injection vulnerability. Consider temporary plugin disabling if upgrading is not immediately possible.
While no public exploits are currently available, the CRITICAL severity suggests a high likelihood of exploitation if left unpatched.
Refer to the ValvePress website and WordPress plugin repository for the latest advisory and update information regarding CVE-2024-27956.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.