WordPress Automatic Plugin vulnerabilities

2 known vulnerabilities in WordPress Automatic Plugin from ValvePress. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  WordPress Automatic Plugin: Unrestricted Upload of File with Dangerous Type

  CVE-2025-5395Jun 11, 2025ValvePress

  The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with

• 9.8 Critical severity

  Automatic: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-27956Mar 21, 2024ValvePressEPSS 94.1%

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.