Description
WordPress Automatic插件是一款用于自动化内容发布的插件。该漏洞存在于插件的csv.php文件中，攻击者可以通过发送特制的SQL查询语句，未经授权地执行任意SQL命令，可能导致数据库信息泄露、数据篡改或服务器被完全控制。
WordPress Automatic 插件 /wp-content/plugins/wp-automatic/inc/csv.php SQL 注入漏洞（CVE-2024-27956）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-27956
https://patchstack.com/database/vulnerability/wp-automatic/wordpress-automatic-plugin-3-92-0-unauthenticated-arbitrary-sql-execution-vulnerability
https://github.com/zeroChen00/exp-poc/blob/main/WordPress-Automatic%E6%8F%92%E4%BB%B6%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E(CVE-2024-27956).md
https://www.venustech.com.cn/new_type/aqtg/20240426/27471.html
https://www.anquanke.com/post/id/296080
https://thehackernews.com/2024/04/hackers-exploiting-wp-automatic-plugin.html
https://wpscan.com/blog/new-malware-campaign-targets-wp-automatic-plugin/
https://www.vicarius.io/vsociety/posts/understanding-and-exploiting-unauthenticated-arbitrary-sql-execution-in-wordpress-automatic-plugin-cve-2024-27956
https://cve.imfht.com/poc_detail/f4f42742e48c1c5b47c8adfe35ed4a601d32d1be