CVE-2024-27956: WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
Published Mar 21, 2024
·Updated
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.
Affected Software
3 affected components
ValvePress Automatic<=3.92.0
WordPress Automatic<=3.92.0
ValvePress Automatic Wordpress<=3.92.0
Remediation
Information
Update to 3.92.1 or a higher version.
Event History
Mar 21, 2024
CVE Published
via MITRE·05:01 PM
Data Sourced
via MITRE·05:01 PM
RemedyDescriptionSeverityWeakness
Apr 25, 2024
News Published
via BleepingComputer·02:27 PM
News Published
via BleepingComputer·02:29 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-27956?
CVE-2024-27956 is classified as a critical SQL Injection vulnerability that can lead to unauthorized access to the database.
2
How do I fix CVE-2024-27956?
To fix CVE-2024-27956, update ValvePress Automatic to version 3.92.1 or later.
3
What versions are affected by CVE-2024-27956?
CVE-2024-27956 affects all versions of ValvePress Automatic up to and including 3.92.0.
4
What type of vulnerability is CVE-2024-27956?
CVE-2024-27956 is an SQL Injection vulnerability due to improper neutralization of special elements.
5
Is CVE-2024-27956 an authenticated issue?
CVE-2024-27956 is an unauthenticated issue, meaning it can be exploited without user login.