InstaWP Connect <= 0.1.0.8 - Cross-Site Request Forgery via create_file_db_manager
Strategic Overview
<= 0.1.0.8N/AVulnerability Overview
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.8. This is due to missing or incorrect nonce validation on the create_file_db_manager() function. This makes it possible for unauthenticated attackers to make use of the file and database manager functionality provided by the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Technical Analysis
REMEDIATION: Update to version 0.1.0.9, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C