Critical severity9.8NVD Advisory· Published May 2, 2024· Updated Apr 8, 2026

CVE-2024-2667

Description

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for unauthenticated attackers to upload arbitrary files.

Affected products

Instawp/Instawp Connect
cpe:2.3:a:instawp:instawp_connect:*:*:*:*:*:wordpress:*:*
Range: <0.1.0.23
WordPress/Instawp Connectllm-fuzzy
Range: <=0.1.0.22
Package: https://wordpress.org/plugins/instawp-connect

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/f6aead8d-c136-4952-ad03-86fe0f144deanvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.005
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000