# CVE-2024-27956: ValvePress - SQLi

> Live exploitation tracking for CVE-2024-27956 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-27956

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.9
- **Public exploit available:** Yes
- **Affected products:** ValvePress Automatic
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** cms, wordpress

## Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

## CrowdSec analysis

[CVE-2024-27956](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-27956) is a high-severity vulnerability in the ValvePress Automatic WordPress plugin, allowing attackers to perform SQL injection through improper handling of user-supplied input.

CrowdSec has been tracking this vulnerability and its exploits since 13th of November 2024.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2024-27956 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
In addition, according to the CrowdSec network, attack volume against CVE-2024-27956 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed exploitation attempts are aimed at the `/wp-content/plugins/wp-automatic/inc/csv.php` path.

## Timeline

- 2024-03-21: CVE Published. CVE-2024-27956 is published to NVD.
- 2024-11-13: Rule Released. CrowdSec releases a rule to detect CVE-2024-27956 exploitation attempts against the CrowdSec Network.
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-27956 for the first time.

## References

- https://patchstack.com/articles/critical-vulnerabilities-patched-in-wordpress-automatic-plugin?_s_id=cve
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27956.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-27956) follows observed exploitation activity for CVE-2024-27956. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.