Critical severity · published Jul 27, 2023
CVE-2023-3956
InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver
9.8
CVSS
1%
EPSS
No
On KEV
Description
The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plugin, change customizer settings, add or modify or delete user including administrator user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
InstaWP Connect – 1-click WP Staging & Migration · instawp
through 0.0.9.18 · source: vendor
IC
Instawp Connect · Instawp
through 0.0.9.18 · source: NVD
Affected product
IC
InstaWP Connect – 1-click WP Staging & Migration
instawp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3956
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3956
Patch
https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.0.9.18/includes/class-instawp-rest-apis.php#L103
Patch
https://plugins.trac.wordpress.org/changeset/2942363/instawp-connect#file5
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/48e7acf2-61d4-4762-8657-0701910ce69b?source=cve
More from InstaWP Connect – 1-click WP Staging & Migration
9.8
CVE-2024-6397
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin
9.8
CVE-2024-4898
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
9.8
CVE-2024-2667
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
8.8
CVE-2024-13913
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion
8.1
CVE-2025-2636
InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion