CVE-2024-4898: InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InstaWP Connect – 1-click WP Staging & Migration (WordPress plugin)to a version that resolves this vulnerability.Fixed in 0.1.0.38
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4898?
CVE-2024-4898 is classified as a high severity vulnerability due to its potential for exploitation by unauthenticated attackers.
How do I fix CVE-2024-4898?
To address CVE-2024-4898, users should update the InstaWP Connect plugin to a version later than 0.1.0.38.
What kind of attacks can be performed due to CVE-2024-4898?
CVE-2024-4898 allows unauthorized attackers to perform arbitrary option updates via unauthenticated REST API calls.
Which versions of the InstaWP Connect plugin are affected by CVE-2024-4898?
All versions of the InstaWP Connect plugin up to and including 0.1.0.38 are affected by CVE-2024-4898.
Is authentication required to exploit CVE-2024-4898?
No, CVE-2024-4898 can be exploited without any authentication, making it particularly dangerous.