CVE-2024-27972
Published: 03 April 2024
Summary
CVE-2024-27972 is a critical-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 2.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-27972 is a code injection vulnerability, tracked as CWE-94, that affects the WP Fusion Lite WordPress plugin from n/a through version 3.41.24. The flaw carries a CVSS 3.1 score of 9.9 and permits improper control over code generation within the plugin component.
An attacker with low-privileged network access and no user interaction required can exploit the issue to execute arbitrary code, resulting in full compromise of confidentiality, integrity, and availability on the affected system with changed scope.
Advisories published by Patchstack classify the flaw as a remote code execution vulnerability in the listed plugin versions and provide the primary public tracking references for the issue.
The associated EPSS score reached a peak of 0.4898 after disclosure before settling at the current value of 0.3816, indicating a material rise that signals emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-25146
Vulnerability details
Improper Control of Generation of Code ('Code Injection') vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite.This issue affects WP Fusion Lite: from n/a through <= 3.41.24.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.