WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability

The SSRF vulnerability in WP Automatic allows an attacker to craft malicious requests that the plugin will execute on the server. This can lead to several severe consequences. An attacker could potentially access internal services that are not directly exposed to the internet, such as database servers, administration panels, or other internal APIs. They could also be used to scan the internal network for other vulnerable services. Successful exploitation could result in data breaches, unauthorized modifications to the WordPress site, or even complete server compromise. The impact is amplified if the WordPress server has access to sensitive data or is part of a larger, interconnected network.

Websites using WP Automatic plugin, particularly those with sensitive internal resources accessible from the WordPress server, are at significant risk. Shared hosting environments where WordPress instances have limited network isolation are also particularly vulnerable, as a compromised plugin could potentially impact other sites on the same server.

• wordpress / composer / npm:

grep -r 'wp_remote_get' /var/www/html/wp-content/plugins/automatic/

• generic web:

curl -I http://your-wordpress-site.com/wp-content/plugins/automatic/ -H 'User-Agent: SSRF-Test'

• wordpress / composer / npm:

wp plugin list --status=active | grep automatic

1. 2024-05-17Disclosure

   disclosure

1. आरक्षित2024-02-28
2. प्रकाशित2024-05-17
3. संशोधित2024-08-02
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-27954 is to immediately upgrade WP Automatic to version 3.92.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a temporary workaround by restricting outbound network access from the WordPress server using a Web Application Firewall (WAF) or proxy. Configure the WAF to block requests to known sensitive internal endpoints. Additionally, review and restrict the plugin's file access permissions to minimize the potential impact of a successful attack. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability using a known payload and verifying that the request is blocked or fails as expected.