CVE-2024-4898

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP 스테이징 및 마이그레이션 = 0.1.0.38 - 인증되지 않은 API 설정/임의 옵션 업데이트/관리자 사용자 생성을 위한 권한 부족...

CVE-2024-2667-Poc

CVE-2024-2667-Poc 🚀 説明 WordPress用プラグイン「InstaWP Connect – 1-click WP Staging & Migration」は、/wp-json/instawp-connect/v1/config REST APIエンドポイントにおけるファイル検証が不十分なため、バージョン0.1.0.22以前の全バージョンにおいて任意ファイルのアップロードが可能です。これにより、認証されていない攻撃者が任意のファイルをアップロードできる可能性があります。 スクリプト使用ガイド ⚙️ 要件のインストール 説明| 詳細| アイコン ---|---|---...

InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...

WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-클릭 WP 스테이징 & 마이그레이션 = 0.1.0.38 - 인증되지 않은 API 설정/임의 옵션 업데이트/관리자 사용자 생성을 위한 권한 누락...

CVE-2024-22145

CVE-2024-22145 InstaWP Connect = 0.1.0.8 - 누락된 권한 확인으로 인한 임의 옵션 업데이트 구독자 이상 설명: InstaWP Connect – 1-click WP Staging & Migration WordPress 플러그인은 0.1.0.8 버전까지 포함한 모든 버전에서 savemanagementsettings 함수에 대한 기능 확인capability check이 누락되어 데이터의 무단 수정에 취약합니다. 이로 인해 구독자 이상의 권한을 가진 인증된 공격자가 수정할 수 있습니다. Severity...

CVE-2024-2667

InstaWP Connect – 원클릭 WP 스테이징 및 마이그레이션 유효하거나 유효하지 않은 API 키를 사용할 수 있습니다. overridepluginzip - 백도어가 포함된 악성 WordPress 플러그인이 들어 있는 zip 파일의 경로입니다. 가져온 후에는 http://victim-domain/wp-content/plugins/malicious-plugin/backdoor.php 를 통해 백도어에 접근할 수 있습니다. 디렉터리 이름이 malicious-plugin이고 backdoor.php가 해당 디렉터리 아래에 있다...

CVE-2026-73401

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

CVE-2026-73401

CVE-2026-73401 affects the WordPress InstaWP Connect plugin (versions

CVE-2026-73401 WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

EUVD-2026-57915

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by rajukani100 in WordPress Plugin InstaWP Connect versions = 0.1.3.7...

CVE-2026-73401: Missing Authorization

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

PT-2026-71605

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457 InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

EUVD-2026-56930

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457 InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthenticated cryptographic key disclosure and potential RCE in all versions up to and including 0.1.3.6. The root cause is storing an encrypted options file as options-{migrate_key}.txt in wp-content/ins...