Unauthorized Data Access Vulnerability in InstaWP Connect Plugin for WordPress
CVE-2023-3956

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
InstaWP Connect – 1-click WP Staging & Migration (beta)
Vendor
CVE Published:
27 July 2023

Summary

The InstaWP Connect plugin for WordPress has a significant vulnerability due to a missing capability check in its 'events_receiver' function. This allows unauthenticated attackers to access sensitive data, modify existing information, and execute unauthorized actions such as installing or deactivating plugins, altering customizer settings, and manipulating user accounts—including those with administrative privileges. Such weaknesses pose a serious threat to the security and integrity of WordPress sites using affected versions up to and including 0.0.9.18.

Affected Version(s)

InstaWP Connect – 1-click WP Staging & Migration (beta) * <= 0.0.9.18

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/instawp-connec...
https://plugins.trac.wordpress.org/changeset/2942363/inst...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lana Codes
.