CVE-2024-4898criticalexploração observadaCWE-862

CVE-2024-4898: falha crítica em InstaWP Connect – 1-click WP Staging & Migration

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar InstaWP Connect – 1-click WP Staging & Migration

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

85Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 9.8epss 4.2%
da publicação à armano mesmo dia
Publicada no NVD12 de jun.
1ª PoC12 de jun.
VulnCheck12 de jun.
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
instawp · InstaWP Connect – 1-click WP Staging & Migration
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — InstaWP Connect – 1-click WP Staging & Migration

No mesmo produto, das mais perigosas para as menos.

CVE-2025-2636HIGHInstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File InclusionEPSS 10.6%CVE-2024-2667CRITICALInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File UploadEPSS 5.7%CVE-2024-13913HIGHInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File InclusionEPSS 2.7%CVE-2023-3956CRITICALInstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiverEPSS 1.0%CVE-2026-13457HIGHInstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key DisclosureEPSS 0.9%CVE-2024-6397CRITICALInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to AdminEPSS 0.7%