CVE-2024-27956: WordPress Automatic plugin unauthenticated SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with unauthenticated network reach and very high EPSS make this an urgent patch target despite no KEV listing.

What it is

The ValvePress Automatic WordPress plugin fails to neutralize special elements in SQL commands, allowing SQL injection through version 3.92.0. The flaw is unauthenticated and remotely reachable, so any exposed site running the affected plugin is at risk of full database compromise.

Impact

An attacker can execute arbitrary SQL against the site's database, potentially reading, altering or deleting data and escalating to broader site takeover.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The vulnerable component is the plugin's SQL handling, exposed to any remote client.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.94057 (99.8th percentile), indicating strong likelihood of exploitation activity. References are third-party advisories only, with no exploit tag supplied.

What to do

• Update the Automatic plugin past version 3.92.0 to the vendor-patched release.
• If patching is not immediately possible, disable or remove the plugin until it can be updated.
• Restrict access to WordPress administrative and plugin endpoints via WAF or network controls.
• Audit the database and site files for signs of tampering after exposure.
• Monitor vendor and Patchstack advisories for further updates.

Detection

• Review web server and WAF logs for SQL metacharacters or UNION/OR patterns in requests to the plugin's endpoints.
• Alert on unexpected database queries or errors originating from the plugin.
• Check for unauthorized admin users, modified content or new scheduled tasks in WordPress.
• Correlate outbound or database activity from the web host with known SQL injection indicators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.