CVE-2024-27954: 
WordPress vulnerability analysis and mitigation

The WordPress Automatic Plugin contains a critical vulnerability (CVE-2024-27954) affecting versions up to and including 3.92.0. This vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) that allows for Server-Side Request Forgery (SSRF) and arbitrary file downloads. The issue was discovered by Rafie Muhammad of Patchstack and has been assigned a critical CVSS score of 9.3 (Patchstack).

The vulnerability is present in the downloader.php file of the WordPress Automatic Plugin. It enables unauthenticated attackers to make web requests to arbitrary locations originating from the web application and allows for arbitrary file downloads. The vulnerability has been assigned CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and received a CVSS v3.1 score of 9.3 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N (WPScan).

The vulnerability allows attackers to query and modify information from internal services and access arbitrary files on the server that may contain sensitive information. Malicious actors can potentially download any file from the affected website, including files containing login credentials and backup files (SecurityOnline).

The vulnerability requires no authentication to exploit, making it particularly dangerous. With over 40,000 active installations, the plugin presents a widespread attack surface. The vulnerability can be exploited by unauthenticated attackers to make web requests to arbitrary locations and download sensitive files (SecurityOnline).

The vulnerability has been patched in version 3.92.1 of the WordPress Automatic Plugin. Site administrators are strongly advised to update to this version immediately. For additional protection, Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users update to the fixed version (Patchstack).