InstaWP Connect < 0.1.0.9 - Missing Authorization to Arbitrary Options Update

2024-01-1800:00:00

wpscan.com

instawp connect

unauthorized modification

missing capability check

data vulnerability

authenticated attackers

software

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_management_settings function in all versions up to, and including, 0.1.0.8. This makes it possible for authenticated attackers, with subscriber access and above, to modify