Description
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery.
References (6)
Core 6
Core References
Scores
CVSS v3
9.8
EPSS
0.0071
EPSS Percentile
48.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-287
CWE-288
Status
published
Products (2)
instawp/InstaWP Connect – 1-click WP Staging & Migration
< 0.1.0.44
instawp/instawp_connect
< 0.1.0.45
Published
Jul 11, 2024
Tracked Since
Feb 18, 2026