CVE-2024-4898 Scanner
CVE-2024-4898 Scanner - Unauthenticated Admin Account Creation vulnerability in WordPress InstaWP Connect
Used 2.7k times · 3.3k assets checked · domain, subdomain, ipv4
CVE
CVE-2024-4898
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
instawp connect – 1-click wp staging & migration
Updated Sep 28, 2026View on NVD →
S4E scanner
CVE history: instawp connect – 1-click wp staging & migration
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →