InstaWP Connect is a widely used WordPress plugin designed to simplify website staging and migration processes. With over 30,000 active installations and a 4.5-star rating in the WordPress Plugin Directory, it serves a significant portion of the WordPress community.

A critical security vulnerability has been identified in versions up to and including 0.1.0.85 of this plugin. This flaw allows unauthenticated users—those without login credentials—to potentially gain unauthorized access to sensitive server files. Such access could lead to full control of the compromised site, posing severe risks to site integrity and user data.

Technical Summary

The vulnerability stems from insufficient input validation in the handling of the instawp-database-manager parameter. Specifically, the plugin fails to properly sanitize user-supplied input, allowing attackers to perform Local File Inclusion (LFI) attacks. By exploiting this flaw, an unauthenticated attacker can include and execute arbitrary PHP files present on the server.

This could be particularly dangerous if the attacker manages to upload malicious files or leverage existing files to execute arbitrary code, potentially resulting in:

• Remote Code Execution (RCE): Execution of arbitrary code on the server.
• Access Control Bypass: Unauthorized access to restricted areas.
• Data Exfiltration: Access to sensitive information stored on the server.

Recommendations

1. Update the plugin: If you are using a version of InstaWP Connect 0.1.0.85 or lower, update to the latest version immediately. Ensure that the update addresses this specific vulnerability.

2. Deactivate or remove the plugin: If an updated version is not yet available or if you cannot update promptly, consider temporarily deactivating or removing the plugin to mitigate the risk.

3. Check server files: Inspect the server for any unauthorized or suspicious files, particularly in directories that allow file uploads.