Login Sign Up

CVE-2023-3956

9.8 CRITICAL
Authentication Bypass

📋 TL;DR

The InstaWP Connect WordPress plugin has a critical vulnerability that allows unauthenticated attackers to perform administrative actions without proper authorization. This includes adding/modifying/deleting posts, users (including administrators), plugins, and customizer settings. All WordPress sites running InstaWP Connect version 0.0.9.18 or earlier are affected.

💻 Affected Systems

Products:
  • InstaWP Connect WordPress Plugin
Versions: All versions up to and including 0.0.9.18
Operating Systems: Any OS running WordPress
Default Config Vulnerable: ⚠️ Yes
Notes: All WordPress installations with the vulnerable plugin version are affected regardless of configuration.

📦 What is this software?

Instawp Connect by Instawp

View all CVEs affecting Instawp Connect →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete site takeover - attackers can create administrator accounts, install malicious plugins, modify all content, and potentially gain server access through plugin installation.

🟠

Likely Case

Site defacement, data theft, or backdoor installation through unauthorized plugin management.

🟢

If Mitigated

Limited impact if proper network segmentation and web application firewalls block unauthorized REST API requests.

🌐 Internet-Facing: HIGH - WordPress sites are typically internet-facing and the exploit requires no authentication.
🏢 Internal Only: MEDIUM - Internal WordPress sites could still be compromised if attackers gain internal network access.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation involves sending crafted HTTP requests to the vulnerable REST API endpoint without authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.0.9.19 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2942363/instawp-connect#file5

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Check if update is available for InstaWP Connect. 4. Click 'Update Now' or manually update to version 0.0.9.19+. 5. Verify plugin is active and functioning.

🔧 Temporary Workarounds

Disable InstaWP Connect Plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate instawp-connect

Block REST API Endpoint

linux

Use web application firewall to block requests to the vulnerable endpoint

# Example .htaccess rule for Apache:
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/instawp-connect/v1/events_receiver
RewriteRule ^ - [F]

🧯 If You Can't Patch

  • Immediately disable or remove the InstaWP Connect plugin from all WordPress installations
  • Implement strict network access controls and web application firewall rules to block unauthorized REST API requests

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Installed Plugins for InstaWP Connect version 0.0.9.18 or earlier

Check Version:

wp plugin get instawp-connect --field=version

Verify Fix Applied:

Verify InstaWP Connect plugin version is 0.0.9.19 or later in WordPress admin

📡 Detection & Monitoring

Log Indicators:

  • Unauthorized POST requests to /wp-json/instawp-connect/v1/events_receiver
  • Unexpected plugin installations/activations
  • New administrator user creation

Network Indicators:

  • HTTP requests to vulnerable REST endpoint without authentication headers
  • Unusual outbound connections after plugin manipulation

SIEM Query:

source="wordpress.log" AND (uri="/wp-json/instawp-connect/v1/events_receiver" OR message="instawp-connect") AND NOT user!=""

📊 Metadata

CVE ID: CVE-2023-3956
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: July 27, 2023
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON