CVE-2024-6397criticalCWE-288

CVE-2024-6397: fallo crítico en InstaWP Connect – 1-click WP Staging & Migration

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear InstaWP Connect – 1-click WP Staging & Migration

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.7%
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
instawp · InstaWP Connect – 1-click WP Staging & Migration
CVEs relacionadas — InstaWP Connect – 1-click WP Staging & Migration

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-2636HIGHInstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File InclusionEPSS 10.6%CVE-2024-2667CRITICALInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File UploadEPSS 5.7%CVE-2024-4898CRITICALInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User CreationEPSS 4.2%CVE-2024-13913HIGHInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File InclusionEPSS 2.7%CVE-2023-3956CRITICALInstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiverEPSS 1.0%CVE-2026-13457HIGHInstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key DisclosureEPSS 0.9%