CVE-2024-27951: themeisle multiple_page_generator
CVSS: 9.1v3.1CriticalModified
Published 03-04-2024Last modified 28-04-2026
Vulnerability summary
CVE-2024-27951 is a critical (CVSS 9.1) vulnerability in themeisle multiple_page_generator. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.8% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)EPSS score
0.60%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 03-04-2024PublishedVulnerability first disclosed.
- 28-04-2026Last modifiedVulnerability information updated.
Description
Unrestricted Upload of File with Dangerous Type vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows Upload a Web Shell to a Web Server.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
CVSS metrics
3 scores · 3 sources · 1 versionCritical 9.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HSources3 sources · 7.2–9.1
- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
- wordfenceSource7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.60% on 19-09-2026
19-09-202619-10-2026
EPSS score0.60%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
Themeisle2 products
- multiple_page_generator< 3.4.1
- multiple page generator plugin – mpg≥ n/a, ≤ 3.4.0
Wordpress1 product
- multiple-pages-generator-by-porthas≤ 3.4.0 (fixed in 3.4.1)
2 vendors · 3 products