CVE-2024-27954
Published: 17 May 2024
Summary
CVE-2024-27954 is a critical-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-27954 is a path traversal vulnerability, tracked as CWE-22, that affects the WP Automatic plugin for WordPress. The flaw exists in versions from n/a through 3.92.0 and permits both path traversal and server-side request forgery.
Unauthenticated remote attackers can exploit the issue over the network without user interaction. Successful exploitation allows arbitrary file download with high confidentiality impact and limited integrity impact while leaving availability unaffected, as reflected in the CVSS 9.3 score.
The vulnerability is documented in the Patchstack database, which identifies the affected plugin versions and confirms the unauthenticated arbitrary file download and SSRF vectors. The current EPSS score of 0.9331, with a peak of 0.9352, indicates sustained exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-25128
Vulnerability details
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Request Forgery.This issue affects Automatic: from n/a through 3.92.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.