InstaWP Connect - Missing Authorization (CVE-2024-4898)
Description
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.
psychologyCrowdSec Analysis
CVE-2024-4898 is a critical vulnerability in the InstaWP Connect – 1-click WP Staging & Migration WordPress plugin that allows unauthenticated attackers to exploit missing authorization checks in REST API calls. This flaw enables remote attackers to edit arbitrary site options, connect the site to external APIs, and even create new administrator accounts, potentially leading to full site compromise.
CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-4898 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit unauthenticated POST requests to the /wp-json/instawp-connect/v1/config REST API endpoint, supplying crafted JSON payloads to create new administrator accounts or modify site options.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-06-12 |
| Rule Released | 2025-09-24 |
| CrowdSec First Seen | 2025-11-19 |