Unauthenticated Authentication Bypass Vulnerability in InstaWP Connect

CVE-2024-6397

Summary

The InstaWP Connect plugin for WordPress, which facilitates 1-click staging and migration, is vulnerable to an authentication bypass issue impacting all versions up to and including 0.1.0.44. This vulnerability arises from inadequate verification of the API key, enabling unauthenticated attackers to gain the ability to log in as any user, including administrators, if they possess the username. Such unauthorized access allows attackers to execute various administrative tasks without proper credentials. While a partial fix was implemented in version 0.1.0.44, the vulnerability remains exploitable through Cross-Site Request Forgery (CSRF) attacks, underscoring the need for vigilance and prompt updates.

References