CVE-2024-6397: InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin
First published: Thu Jul 11 2024(Updated: )
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| InstaWP Connect | <0.1.0.45 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/963f2485-3afa-4e17-8278-b75415af3915?source=cve
- https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/class-instawp-hooks.php#L28
- https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/class-instawp-hooks.php#L40
- https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/apis/class-instawp-rest-api.php#L256
- https://plugins.trac.wordpress.org/changeset/3109305/
- https://plugins.trac.wordpress.org/changeset/3114674/
Frequently Asked Questions
What is the severity of CVE-2024-6397?
CVE-2024-6397 has a high severity due to the potential for unauthorized access.
How do I fix CVE-2024-6397?
To fix CVE-2024-6397, update the InstaWP Connect plugin to version 0.1.0.45 or later.
Which versions are affected by CVE-2024-6397?
All versions of the InstaWP Connect plugin up to and including 0.1.0.44 are affected by CVE-2024-6397.
What type of vulnerability is CVE-2024-6397?
CVE-2024-6397 is an authentication bypass vulnerability.
Who can exploit CVE-2024-6397?
CVE-2024-6397 can be exploited by unauthenticated attackers, allowing them to log in without proper credentials.
- agent/title
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- agent/weakness
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/instawp
- canonical/instawp connect