CVE-2024-27954
📋 TL;DR
This vulnerability in the WordPress Automatic plugin allows unauthenticated attackers to perform path traversal attacks, potentially downloading arbitrary files from the server, and execute server-side request forgery (SSRF) attacks. It affects all WordPress sites running the Automatic plugin versions up to 3.92.0. Attackers can exploit this without any authentication.
💻 Affected Systems
- WordPress Automatic Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through arbitrary file download of sensitive files (like wp-config.php containing database credentials) followed by SSRF to internal services, potentially leading to data breach, ransomware deployment, or lateral movement.
Likely Case
Unauthenticated attackers download WordPress configuration files to obtain database credentials, then use SSRF to probe internal networks or attack internal services, leading to site defacement, data theft, or further exploitation.
If Mitigated
If web application firewalls block path traversal patterns and restrict outbound requests, exploitation attempts are logged and blocked, preventing data exfiltration and internal network access.
🎯 Exploit Status
Public proof-of-concept code exists demonstrating both path traversal and SSRF. The unauthenticated nature and low complexity make this highly attractive for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.92.1
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Automatic' plugin. 4. Click 'Update Now' if update available. 5. If no update shows, manually download version 3.92.1+ from WordPress.org and replace plugin files via FTP/SFTP.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the Automatic plugin until patched to prevent exploitation.
wp plugin deactivate wp-automatic
Web Application Firewall Rules
allConfigure WAF to block path traversal patterns (../, ..\, etc.) and restrict outbound HTTP requests from the web server.
🧯 If You Can't Patch
- Immediately deactivate and remove the Automatic plugin from all WordPress installations.
- Implement network segmentation to restrict web server outbound connections to only necessary external services.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for 'Automatic' plugin version. If version is 3.92.0 or lower, you are vulnerable.Check Version:
wp plugin get wp-automatic --field=versionVerify Fix Applied:
After update, verify plugin version shows 3.92.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' or '..\' patterns in URL parameters
- Unusual outbound HTTP requests from web server to internal IP addresses or unusual domains
- Multiple failed attempts to access wp-config.php or other sensitive files
Network Indicators:
- Outbound HTTP requests from web server to internal network ranges (192.168.x.x, 10.x.x.x, 172.16.x.x)
- Unusual traffic patterns to plugin-specific endpoints (/wp-content/plugins/wp-automatic/)
SIEM Query:
source="web_server_logs" AND (url="*../*" OR url="*..\\*" OR url="*/wp-content/plugins/wp-automatic/*")🔗 References
- https://patchstack.com/database/vulnerability/wp-automatic/wordpress-automatic-plugin-3-92-0-unauthenticated-arbitrary-file-download-and-ssrf-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/wp-automatic/wordpress-automatic-plugin-3-92-0-unauthenticated-arbitrary-file-download-and-ssrf-vulnerability?_s_id=cve
