# CVE-2024-4898: InstaWP Connect - Missing Authorization

> Live exploitation tracking for CVE-2024-4898 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-4898

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** InstaWP Connect
- **Weaknesses:** CWE-862 (Missing Authorization)
- **Tags:** wordpress

## Description

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.

## CrowdSec analysis

[CVE-2024-4898](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-4898) is a critical vulnerability in the InstaWP Connect – 1-click WP Staging & Migration WordPress plugin that allows unauthenticated attackers to exploit missing authorization checks in REST API calls. This flaw enables remote attackers to edit arbitrary site options, connect the site to external APIs, and even create new administrator accounts, potentially leading to full site compromise.

CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-4898 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit unauthenticated POST requests to the `/wp-json/instawp-connect/v1/config` REST API endpoint, supplying crafted JSON payloads to create new administrator accounts or modify site options.

## Timeline

- 2024-06-12: CVE Published. CVE-2024-4898 is published to NVD.
- 2025-09-24: Rule Released. CrowdSec releases a rule to detect CVE-2024-4898 exploitation attempts against the CrowdSec Network.
- 2025-11-19: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-4898 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4898.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-4898) follows observed exploitation activity for CVE-2024-4898. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.