CVE-2024-27956 PoC — WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

Source

https://github.com/ThatNotEasy/CVE-2024-27956

Associated Vulnerability

Title: WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability (CVE-2024-27956)
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

Description

Perform with massive Wordpress SQLI 2 RCE

Readme

# Wordpress SQLI-2-RCE Exploit
- This Python script exploits CVE-2024-27956, a vulnerability in Wordpress that allows for SQL Injection leading to Remote Code Execution (RCE).

# Features
- Multi-threaded Exploitation: Utilizes concurrent threads to exploit multiple Wordpress instances simultaneously.
- Dynamic Payload Injection: Constructs SQL queries dynamically to inject malicious code into vulnerable Wordpress installations.
- Detailed Logging and Error Handling: Uses colorama and coloredlogs for enhanced console output with color-coded messages.

# Requirements
- Python 3.x
- Required Python packages (requests, argparse, colorama, coloredlogs, concurrent.futures)\

# Usage
- python exploit.py -f urls.txt [-t NUM_THREADS]
- -f, --file: File containing URLs/IPs of Wordpress instances, one per line.
- -t, --threads: Number of threads to use for concurrent requests (default: 5).

# Author
- Pari Malam

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →