Skip to content
OpenAdvisories

Vendor

InstaWP

22 known vulnerabilities.

Products

InstaWP Connect 11 InstaWP Connect – 1-click WP Staging & Migration 8 String locator 3
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-6397

    InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin

    The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticate…

    InstaWP InstaWP Connect – 1-click WP Staging & Migration Web / CMS
  • Critical 10.0
    CVE-2024-37228

    WordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.38.

    InstaWP InstaWP Connect
  • Critical 9.8
    CVE-2024-4898 Public exploit Scanner template

    InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation

    The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthen…

    InstaWP InstaWP Connect – 1-click WP Staging & Migration Web / CMS
  • Critical 9.8
    CVE-2024-2667 Public exploit Scanner template

    InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

    The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. T…

    InstaWP InstaWP Connect – 1-click WP Staging & Migration Web / CMS
  • Critical 9.9
    CVE-2024-25918

    WordPress InstaWP Connect plugin <= 0.1.0.8 - Remote Code Execution vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8.

    InstaWP InstaWP Connect
  • Critical 9.8
    CVE-2023-3956

    InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver

    The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible…

    InstaWP InstaWP Connect – 1-click WP Staging & Migration Web / CMS