CVE-2024-22145
HIGH EXPLOITEDInstaWP Connect <0.1.0.8 - Privilege Escalation
Title source: llmExploitation Summary
CVE-2024-22145 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including RandomRobbieBF.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-22145, which allows authenticated attackers with subscriber-level access to modify WordPress options due to a missing capability check in the InstaWP Connect plugin. The exploit demonstrates the vulnerability by enabling user registration and setting the default role to administrator.
Description
Incorrect Privilege Assignment vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8.
Exploits (1)
This repository contains a functional exploit for CVE-2024-22145, which allows authenticated attackers with subscriber-level access to modify WordPress options due to a missing capability check in the InstaWP Connect plugin. The exploit demonstrates the vulnerability by enabling user registration and setting the default role to administrator.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H