PT-2024-27397 · Unknown · Instawp Connect

Ataturk1925 · Published 2024-06-24 · Updated 2025-02-06 · CVE-2024-37228

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InstaWP Connect versions 0.1.0.38 and earlier

Description The issue is related to an Improper Control of Generation of Code ('Code Injection') vulnerability, which allows Code Injection.

Recommendations For InstaWP Connect versions 0.1.0.38 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

CVE-2024-37228

Affected Products

Instawp Connect

References · 6

• https://osv.dev/vulnerability/CVE-2024-37228 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37228 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-0-38-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/110237 · Telegram Post
• https://t.me/cvenotify/84171 · Telegram Post
• https://patchstack.com/database/vulnerability/instawp-connect/wordpress-instawp-connect-plugin-0-1-0-38-arbitrary-file-upload-vulnerability?_s_id=cve · Note