CVE-2024-27972 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Product**: WordPress Plugin WP Fusion Lite. 👤 **Vendor**: Jack Arturo. 📅 **Affected Versions**: Versions <= 3.41.24. ⚠️ **Scope**: Any WordPress site running this specific plugin version.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check installed plugins for 'WP Fusion Lite'. 2. Verify version is <= 3.41.24. 3. Scan for `call_user_func` usage in `includes/class-shortcodes.php`. 🛠️ **Tools**: Use WPScan or manual code review.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: Update to version > 3.41.24. 📢 **Source**: Patchstack and vendor advisories confirm the fix. ⏳ **Action**: Immediate upgrade is the primary mitigation strategy.

Q: Is it urgent? (Priority Suggestion)

🚨 **Urgency**: CRITICAL (CVSS 9.8). 📢 **Priority**: Patch IMMEDIATELY. This is an RCE vulnerability with a public PoC. Delaying puts the entire WordPress infrastructure at severe risk of compromise.

Updated May 08, 2026 CVSS 9.9 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Critical Remote Code Execution (RCE) in WP Fusion Lite. 📉 **Consequences**: Full server compromise.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-94 (Code Injection). 💥 **Flaw**: The plugin uses `call_user_func` with unsanitized input in `class-shortcodes.php`.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Product**: WordPress Plugin WP Fusion Lite. 👤 **Vendor**: Jack Arturo. 📅 **Affected Versions**: Versions <= 3.41.24. ⚠️ **Scope**: Any WordPress site running this specific plugin version.

Q4What can hackers do? (Privileges/Data)

🔓 **Privileges**: Attacker gains the same privileges as the WordPress user (Contributor+). 💾 **Data**: Full Read/Write/Execute access.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔑 **Auth Required**: YES. 📊 **Threshold**: Low-Medium. Requires an authenticated account with at least 'Contributor' level privileges. 🌐 **Network**: Network Accessible (AV:N).…

Read full answer (login)

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Public Exploit**: YES. 📂 **PoC Available**: GitHub repo `truonghuuphuc/CVE-2024-27972-Poc` exists. 🌍 **Wild Exploitation**: High risk.…

Read full answer (login)

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check installed plugins for 'WP Fusion Lite'. 2. Verify version is <= 3.41.24. 3. Scan for `call_user_func` usage in `includes/class-shortcodes.php`. 🛠️ **Tools**: Use WPScan or manual code review.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: Update to version > 3.41.24. 📢 **Source**: Patchstack and vendor advisories confirm the fix. ⏳ **Action**: Immediate upgrade is the primary mitigation strategy.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. Disable the plugin immediately if not critical. 2. Restrict user roles (remove Contributor+ access if possible). 3. Implement WAF rules to block malicious shortcode injections.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🚨 **Urgency**: CRITICAL (CVSS 9.8). 📢 **Priority**: Patch IMMEDIATELY. This is an RCE vulnerability with a public PoC. Delaying puts the entire WordPress infrastructure at severe risk of compromise.

Continue exploring

Vulnerability detail Full AI analysis (login) Jack Arturo CWE-94