CVE-2024-4898criticalexplotación observadaCWE-862

CVE-2024-4898: fallo crítico en InstaWP Connect – 1-click WP Staging & Migration

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear InstaWP Connect – 1-click WP Staging & Migration

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

85Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 9.8epss 4.2%
de la publicación al armael mismo día
Publicada en NVD12 jun
1ª PoC12 jun
VulnCheck12 jun
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
instawp · InstaWP Connect – 1-click WP Staging & Migration
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — InstaWP Connect – 1-click WP Staging & Migration

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-2636HIGHInstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File InclusionEPSS 10.6%CVE-2024-2667CRITICALInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File UploadEPSS 5.7%CVE-2024-13913HIGHInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File InclusionEPSS 2.7%CVE-2023-3956CRITICALInstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiverEPSS 1.0%CVE-2026-13457HIGHInstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key DisclosureEPSS 0.9%CVE-2024-6397CRITICALInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to AdminEPSS 0.7%