CVE-2024-27956

ValvePress Automatic accepts input that flows unsanitized into an SQL query, and the injection reaches with no authentication and crosses a trust boundary in the process. On a WordPress plugin that means an unauthenticated attacker can manipulate the database directly, which is a short hop from reading credentials to seizing an administrative account and, from there, the whole site.

This is the profile that mass-scanning campaigns love: a widely deployed plugin, no login to defeat, and a near-top score. Public unauthenticated SQL injection in WordPress plugins typically draws automated exploitation quickly, hitting every reachable install without discrimination, because the payoff — database access leading to site takeover — is generic and reliable.

The hard part for us isn't understanding the bug, it's the WordPress inventory problem: these plugins are installed per-site by owners who rarely track them centrally. So we focus on answering, across everything we host, which sites run Automatic, at what version, and whether the vulnerable path is internet-reachable. Where we can't update fast enough, a WAF rule targeting the injection pattern is a reasonable stopgap, but the durable fix is getting that version list to a patched ceiling.