PT-2024-21210 · Unknown · Instawp Connect

Majed Refaea · Published 2024-04-03 · Updated 2025-02-09 · CVE-2024-25918

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InstaWP Connect versions 0.1.0.8 and earlier

Description The issue allows for code injection due to an unrestricted upload of file with dangerous type vulnerability. This enables remote attackers to upload malicious files, potentially leading to code execution.

Recommendations For InstaWP Connect versions 0.1.0.8 and earlier, update to a newer version or disable the plugin to prevent exploitation. As a temporary workaround, consider restricting access to the plugin until a patch is available.

Fix

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

CVE-2024-25918

Affected Products

Instawp Connect

References · 8

• https://osv.dev/vulnerability/CVE-2024-25918 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25918 · Security Note
• https://twitter.com/CVEnew/status/1775500281884680694 · Twitter Post
• https://twitter.com/oktsec/status/1779102674517905756 · Twitter Post
• https://patchstack.com/database/vulnerability/instawp-connect/wordpress-instawp-connect-plugin-0-1-0-8-remote-code-execution-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/110511 · Telegram Post
• https://t.me/cvenotify/75625 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-0-8-remote-code-execution-vulnerability?_s_id=cve · Note