CVE-2024-6397
Critical
Description
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery.
SeverityCritical
CVSS9.8
Exploit probability—
ProductInstawp Connect
PublishedJul 11, 2024
First seenJul 11, 2024
Weakness typeCWE-288CWE-288
How to fix
Update
- instawp instawp_connect0.1.0.45 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| instawp instawp_connect | v < 0.1.0.45 | 0.1.0.45 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.