CVE-2024-27972: WordPress WP Fusion Lite plugin <= 3.41.24…

Record summary

CVE-2024-27972 has a selected CVSS score of 9.9 (critical).

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite.This issue affects WP Fusion Lite: from n/a through <= 3.41.24.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV: Listed · Mar 13, 2024 · VulnCheck
Reported exploitation: Observed · VulnCheck

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 9, 2024 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
WP Fusion Lite Browse Jack Arturo / WP Fusion Lite Default status: unaffected	CVE List	Through 3.41.24	affected
WP Fusion Lite Browse Very Good Plugins / WP Fusion Lite	VulnCheck	Version data not supplied
wp_fusion Browse verygoodplugins / wp_fusion Default status: unknown	CVE List	Through 3.41.24	affected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2024-27972

patchstack.comvdb entry

https://patchstack.com/database/Wordpress/Plugin/wp-fusion-lite/vulnerability/wordpress-wp-fusion-lite-plugin-3-41-24-remote-code-execution-rce-vulnerability?_s_id=cve