CVE-2024-2667

This PoC demonstrates an unauthenticated arbitrary file upload vulnerability in InstaWP Connect plugin versions up to 0.1.0.22. It allows an attacker to upload a malicious WordPress plugin via a REST API endpoint, leading to remote code execution.

This PoC exploits CVE-2024-2667, an arbitrary file upload vulnerability in the InstaWP Connect WordPress plugin (versions <= 0.1.0.22). It checks the target's plugin version and attempts to upload a malicious plugin via the REST API endpoint.

The repository contains functional exploit code for CVE-2024-2667, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.