Unauthorized Data Access Vulnerability in InstaWP Connect Plugin for WordPress
CVE-2023-3956
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 July 2023
What is CVE-2023-3956?
The InstaWP Connect plugin for WordPress has a significant vulnerability due to a missing capability check in its 'events_receiver' function. This allows unauthenticated attackers to access sensitive data, modify existing information, and execute unauthorized actions such as installing or deactivating plugins, altering customizer settings, and manipulating user accounts—including those with administrative privileges. Such weaknesses pose a serious threat to the security and integrity of WordPress sites using affected versions up to and including 0.0.9.18.
Affected Version(s)
InstaWP Connect – 1-click WP Staging & Migration (beta) * <= 0.0.9.18