WordPress Automatic Plugin

WordPress Automatic Plugin has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; all 10 are fixed as of September 2026. Their average CVSS score is 8.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 4 critical and 3 high. 2024 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (20%). Other recurring categories include Cross-Site Scripting, SQL Injection.

Every one of the 10 issues recorded for WordPress Automatic Plugin has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, most of them (4) reported by Rafie Muhammad.

Strategic Overview

Avg CVSSHigh

8.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WordPress Automatic Plugin vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-27954

Automatic <= 3.92.0 - Unauthenticated Arbitrary File Download and Server-Side Request Forgery

Read the full analysis

Vulnerability Records

10 records


2026-06-25 00:00	WordPress Automatic Plugin < 3.135.1 - Unauthenticated Stored Cross-Site Scripting WordPress Automatic Plugin < 3.135.1	`CVE-2026-56045`	7.2 High	Nguyen Ba Khanh	Yes
2025-08-25 20:27	WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting WordPress Automatic Plugin <= 3.118.0	`CVE-2025-6247`	4.7 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes
2025-06-10 00:00	WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload WordPress Automatic Plugin <= 3.115.0	`CVE-2025-5395`	8.8 High	Trương Hữu Phúc (truonghuuphuc)	Yes
2024-05-17 17:27	WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter WordPress Automatic Plugin <= 3.94.0	`CVE-2024-4849`	6.4 Medium	haidv35	Yes
2024-04-19 00:00	WordPress Automatic Plugin <= 3.92.1 Cross-Site Request Forgery WordPress Automatic Plugin <= 3.92.1	`CVE-2024-32693`	5.4 Medium	Rafie Muhammad	Yes
2024-03-13 00:00	Automatic <= 3.92.0 - Cross-Site Request Forgery to Privilege Escalation WordPress Automatic Plugin <= 3.92.0	`CVE-2024-27955`	8.8 High	Rafie Muhammad	Yes
2024-03-13 00:00	Automatic <= 3.92.0 - Unauthenticated Arbitrary File Download and Server-Side Request Forgery WordPress Automatic Plugin <= 3.92.0	`CVE-2024-27954`	9.8 Critical	Rafie Muhammad	Yes
2024-03-13 00:00	Automatic <= 3.92.0 - Unauthenticated SQL Injection WordPress Automatic Plugin <= 3.92.0	`CVE-2024-27956`	9.8 Critical	Rafie Muhammad	Yes
2021-09-06 00:00	WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update WordPress Automatic Plugin < 3.53.3	`CVE-2021-4374`	9.1 Critical	Jerome Bruandet	Yes
2014-08-01 00:00	WordPress Automatic Plugin <= 2.0.3 - Cross-Site Request Forgery to SQL Injection WordPress Automatic Plugin <= 2.0.3	`N/A`	9.8 Critical	NICK58	Yes

Showing 1–10 of 10 reports