CVE-2024-27956

Critical

Published: 21 March 2024

Published

21 March 2024

Modified

28 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

EPSS Score 0.9369 99.9th percentile

Risk Priority 76 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-27956 is a critical-severity SQL Injection (CWE-89) vulnerability in Valvepress Automatic. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Other ATLAS/OWASP Terms risk domain; MITRE ATLAS techniques in scope: Obtain Capabilities (AML.T0016), AI Model Inference API Access (AML.T0040), External Harms (AML.T0048).

Deeper analysis

CVE-2024-27956 is an unauthenticated SQL injection vulnerability (CWE-89) affecting the ValvePress Automatic WordPress plugin in versions up to and including 3.92.0. The flaw stems from improper neutralization of special elements in SQL commands and carries a CVSS 3.1 score of 9.9, reflecting network-accessible exploitation with low attack complexity, no required credentials or user interaction, and changed scope.

An attacker with no privileges can send crafted requests to the plugin that result in arbitrary SQL execution. Successful exploitation can alter or exfiltrate database contents, with high integrity impact and secondary effects on confidentiality and availability.

Patchstack advisories note that the issue was addressed in a subsequent plugin release and recommend immediate update of Automatic to a fixed version. The associated EPSS score remains near its observed peak of 0.9389.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-25130

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

CWE(s): CWE-89

AI Security AnalysisAI

AI Category: Enterprise AI Assistants
Risk Domain: Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025: None mapped
Classification Reason: The WordPress Automatic plugin by ValvePress integrates OpenAI GPT for automated content generation, functioning as an AI-assisted tool for content posting and scraping, fitting the Enterprise AI Assistants category despite the SQL injection vulnerability being in a non-AI specific component.

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection (CVE-2024-27956) in public-facing WordPress plugin enables exploitation (T1190) and arbitrary database access for data collection (T1213.006). Associated unauthenticated arbitrary file download facilitates collection of data from local system (T1005).