cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2024-6397,https://securityvulnerability.io/vulnerability/CVE-2024-6397,Unauthenticated Authentication Bypass Vulnerability in InstaWP Connect,"The InstaWP Connect plugin for WordPress, which facilitates 1-click staging and migration, is vulnerable to an authentication bypass issue impacting all versions up to and including 0.1.0.44. This vulnerability arises from inadequate verification of the API key, enabling unauthenticated attackers to gain the ability to log in as any user, including administrators, if they possess the username. Such unauthorized access allows attackers to execute various administrative tasks without proper credentials. While a partial fix was implemented in version 0.1.0.44, the vulnerability remains exploitable through Cross-Site Request Forgery (CSRF) attacks, underscoring the need for vigilance and prompt updates.",Wordpress,InstaWP Connect,9.8,CRITICAL,0.0004400000034365803,false,,false,false,false,,,false,false,,2024-07-11T04:15:00.000Z,0
CVE-2024-4898,https://securityvulnerability.io/vulnerability/CVE-2024-4898,Unauthorized Access to Site Options and Administrator Accounts via REST API,"The InstaWP Connect plugin for WordPress contains a security flaw that allows for arbitrary option updates through unauthenticated access. This vulnerability arises from a lack of proper authorization checks during REST API calls, affecting all versions up to and including 0.1.0.38. Attackers exploiting this vulnerability can connect the affected WordPress site to InstaWP APIs, modify site options without authentication, and potentially create administrator accounts, posing significant risks to site integrity and security.",Wordpress,InstaWP Connect,9.8,CRITICAL,0.0004299999854993075,false,,false,false,true,2024-06-12T19:03:14.000Z,true,false,false,,2024-06-12T11:15:00.000Z,0
CVE-2024-2667,https://securityvulnerability.io/vulnerability/CVE-2024-2667,Unauthenticated File Upload Vulnerability in InstaWP Connect,"The InstaWP Connect plugin for WordPress is susceptible to a vulnerability that allows unauthenticated users to upload arbitrary files. This stems from inadequate file validation within the REST API endpoint located at /wp-json/instawp-connect/v1/config. All versions of the plugin up to and including 0.1.0.22 are affected, enabling potential threats that could compromise the integrity of the hosting environment.",Wordpress,InstaWP Connect – 1-click WP Staging & Migration,9.8,CRITICAL,0.0004299999854993075,false,,false,false,true,2024-04-29T02:14:47.000Z,true,false,false,,2024-05-02T16:52:52.798Z,0