Description
WordPress Plugin InstaWP Connect-1-click WP Staging & Migration is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently log in as any existing user on the site, such as an administrator, if they have access to the username, and perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery. WordPress Plugin InstaWP Connect-1-click WP Staging & Migration version 0.1.0.44 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 0.1.0.45 or latest
References
Related Vulnerabilities
WordPress Plugin WP Socializer-Simple & Easy Social Media Share Icons Cross-Site Scripting (7.2)
Perl Out-of-bounds Read Vulnerability (CVE-2018-18313)
WordPress 6.1.x Multiple Vulnerabilities (6.1 - 6.1.6)
WordPress Plugin PDF Flipbook, 3D Flipbook WordPress-DearFlip Cross-Site Scripting (1.7.9)
WordPress Plugin Quick Event Manager Cross-Site Scripting (9.6.4)