CVE-2024-6397: InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InstaWP Connect – 1-click WP Staging & Migrationto a version that resolves this vulnerability.Fixed in 0.1.0.44
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6397?
CVE-2024-6397 has a high severity due to the potential for unauthorized access.
How do I fix CVE-2024-6397?
To fix CVE-2024-6397, update the InstaWP Connect plugin to version 0.1.0.45 or later.
Which versions are affected by CVE-2024-6397?
All versions of the InstaWP Connect plugin up to and including 0.1.0.44 are affected by CVE-2024-6397.
What type of vulnerability is CVE-2024-6397?
CVE-2024-6397 is an authentication bypass vulnerability.
Who can exploit CVE-2024-6397?
CVE-2024-6397 can be exploited by unauthenticated attackers, allowing them to log in without proper credentials.