CVE-2023-3956: InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver
The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'eventsreceiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plugin, change customizer settings, add or modify or delete user including administrator user.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3956?
CVE-2023-3956 is considered to be of high severity due to the potential for unauthorized access and data modification.
How do I fix CVE-2023-3956?
To remediate CVE-2023-3956, update the InstaWP Connect plugin to version 0.0.9.19 or later.
Who is affected by CVE-2023-3956?
Users of the InstaWP Connect plugin for WordPress versions up to and including 0.0.9.18 are affected by CVE-2023-3956.
What types of attacks are possible with CVE-2023-3956?
CVE-2023-3956 allows unauthenticated attackers to add, modify, or delete data due to a lack of proper capability checks.
Is CVE-2023-3956 a WordPress core issue?
No, CVE-2023-3956 is specific to the InstaWP Connect plugin and not a vulnerability in the WordPress core itself.