Cross-Site Request Forgery in InstaWP Connect Plugin for WordPress

CVE-2024-13913

What is CVE-2024-13913?

The InstaWP Connect plugin, used for 1-click WordPress staging and migration, contains a susceptibility to Cross-Site Request Forgery due to inadequate nonce validation in the '/migrate/templates/main.php' file. This vulnerability allows unauthenticated attackers to include and execute arbitrary files on the server. Exploiting this flaw could allow the execution of any PHP code contained in the files, potentially leading to unauthorized access, sensitive data retrieval, and code execution by exploiting upload functionalities that may permit seemingly 'safe' file types.

References