# WordPress Automatic Plugin

> Not on WordPress.org: a premium or commercial plugin that updates from its vendor.

Source: https://todaywp.com (Today WP, free and read-only). 

## Facts

- Slug: wp-automatic
- To check an installed version: wp_security with plugins "wp-automatic:<version>".

## Known vulnerabilities

- 2026-06-26 HIGH: Unauthenticated Stored Cross-Site Scripting (before 3.135.1). CVE-2026-56045, https://www.wordfence.com/threat-intel/vulnerabilities/id/045f52f2-b77d-4ddb-a674-0fccf3e6dc7d?source=api-prod
- 2025-08-25 MEDIUM: AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (up to 3.118.0). CVE-2025-6247, https://www.wordfence.com/threat-intel/vulnerabilities/id/95d68a5d-4d0b-4030-a80a-ada31b118af2?source=api-prod
- 2025-06-10 HIGH: AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload (up to 3.115.0). CVE-2025-5395, https://www.wordfence.com/threat-intel/vulnerabilities/id/57be67fd-8485-495f-b5e9-6eb52af945b7?source=api-prod
- 2024-05-17 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter (up to 3.94.0). CVE-2024-4849, https://www.wordfence.com/threat-intel/vulnerabilities/id/4be58bfa-d489-45f5-9169-db8bab718175?source=api-prod
- 2024-04-19 MEDIUM: WordPress Automatic Plugin <= 3.92.1 Cross-Site Request Forgery (up to 3.92.1). CVE-2024-32693, https://www.wordfence.com/threat-intel/vulnerabilities/id/6231e47e-2120-4746-97c1-2aa80aa18f4e?source=api-prod
- 2024-03-13 HIGH: Cross-Site Request Forgery to Privilege Escalation (up to 3.92.0). CVE-2024-27955, https://www.wordfence.com/threat-intel/vulnerabilities/id/12adf619-4be8-4ecf-8f67-284fc44d87d0?source=api-prod
- 2024-03-13 CRITICAL: Unauthenticated Arbitrary File Download and Server-Side Request Forgery (up to 3.92.0). CVE-2024-27954, https://www.wordfence.com/threat-intel/vulnerabilities/id/620e8931-64f0-4d9c-9a4c-1f5a703845ff?source=api-prod
- 2024-03-13 CRITICAL: Unauthenticated SQL Injection (up to 3.92.0). CVE-2024-27956, https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b319be-f312-4d02-840f-e2a91c16b67a?source=api-prod
- 2021-09-06 CRITICAL: Unauthenticated Arbitrary Options Update (before 3.53.3). CVE-2021-4374, https://www.wordfence.com/threat-intel/vulnerabilities/id/d0567dc8-7a4c-42f4-bf45-f31a8efaa354?source=api-prod
- 2014-08-01 CRITICAL: Cross-Site Request Forgery to SQL Injection (up to 2.0.3). WF-fa45d830-fa28-4d94-a6d5-2dc2b8456cf2, https://www.wordfence.com/threat-intel/vulnerabilities/id/fa45d830-fa28-4d94-a6d5-2dc2b8456cf2?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.