# InstaWP Connect 0.1.0.38 未授权API漏洞
## 漏洞概述
InstaWP Connect – 1-click WP Staging & Migration 插件中存在一个漏洞，该漏洞允许未经授权的攻击者通过 REST API 调用更新任意选项，包括将网站连接到 InstaWP API、编辑任意站点选项和创建管理员账户。
## 影响版本
所有版本直到且包括 0.1.0.38
## 漏洞细节
该漏洞是由于 REST API 调用中缺少授权检查，导致未经授权的用户可以执行敏感操作，如更新任意选项、连接到 InstaWP API 和创建管理员账户。
## 影响
该漏洞允许攻击者：
- 将目标站点连接到 InstaWP API
- 编辑任意站点选项
- 创建新的管理员账户
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation | https://github.com/truonghuuphuc/CVE-2024-4898-Poc | POC详情 |
| 2 | None | https://github.com/cve-2024/CVE-2024-4898-Poc | POC详情 |
| 3 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4898.yaml | POC详情 |
| 4 | CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation | https://github.com/gh-ost00/CVE-2024-4898 | POC详情 |
暂无评论