CVE-2024-13913: InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13913?
CVE-2024-13913 has a moderate severity due to its potential impact on application integrity through Cross-Site Request Forgery.
How do I fix CVE-2024-13913?
To fix CVE-2024-13913, update the InstaWP Connect plugin to the latest version beyond 0.1.0.83, which includes proper nonce validation.
What versions are affected by CVE-2024-13913?
CVE-2024-13913 affects all versions of the InstaWP Connect plugin up to and including 0.1.0.83.
What type of vulnerability is CVE-2024-13913?
CVE-2024-13913 is a Cross-Site Request Forgery (CSRF) vulnerability.
Where in the codebase is CVE-2024-13913 found?
CVE-2024-13913 is located in the '/migrate/templates/main.php' file of the InstaWP Connect plugin.