.. / CVE-2024-27954

• SSRF
• PoC
• Nuclei
• Web

Exploit for WordPress Plugin Automatic < 3.92.1 - Unauthenticated Server-Side Request Forgery (CVE-2024-27954)

Description:

WordPress Automatic plugin <3.92.1 is vulnerable to unauthenticated Arbitrary File Download and SSRF Located in the downloader.php file, could permit attackers to download any file from a site. Sensitive data, including login credentials and backup files, could fall into the wrong hands. This vulnerability has been patched in version 3.92.1.

Affected Products:

• WordPress Plugin Automatic < 3.92.1

Nuclei Template

View the template here CVE-2024-27954.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2024/CVE-2024-27954.yaml

References: