Critical severity · published Jul 11, 2024
CVE-2024-6397
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
InstaWP Connect – 1-click WP Staging & Migration · instawp
through 0.1.0.44 · source: vendor
IC
Instawp Connect · Instawp
before 0.1.0.45 · source: NVD, CISA
Affected product
IC
InstaWP Connect – 1-click WP Staging & Migration
instawp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6397
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6397
Product
https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/apis/class-instawp-rest-api.php#L256
Product
https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/class-instawp-hooks.php#L28
Product
https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/class-instawp-hooks.php#L40
Patch
https://plugins.trac.wordpress.org/changeset/3109305/
Patch
https://plugins.trac.wordpress.org/changeset/3114674/
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/963f2485-3afa-4e17-8278-b75415af3915?source=cve
More from InstaWP Connect – 1-click WP Staging & Migration
9.8
CVE-2024-4898
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
9.8
CVE-2024-2667
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
9.8
CVE-2023-3956
InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver
8.8
CVE-2024-13913
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion
8.1
CVE-2025-2636
InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion