CVE-2024-25918: InstaWP Connect RCE Vulnerability

CVE-2024-25918 Overview

CVE-2024-25918 is a code injection vulnerability [CWE-94] affecting the InstaWP Connect plugin for WordPress. The flaw impacts all versions of instawp-connect up to and including version 0.1.0.8. An authenticated attacker with low privileges can send crafted input over the network to trigger arbitrary code execution on the underlying WordPress host. Successful exploitation compromises confidentiality, integrity, and availability of the affected site.

Critical Impact

Attackers with low-privileged accounts can execute arbitrary PHP code on WordPress sites running vulnerable versions of the InstaWP Connect plugin, leading to full site takeover.

Affected Products

• InstaWP Connect plugin for WordPress (instawp-connect)
• All versions from initial release through 0.1.0.8
• WordPress sites with the plugin installed and activated

Discovery Timeline

• 2024-04-03 - CVE-2024-25918 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25918

Vulnerability Analysis

The vulnerability is classified as Improper Control of Generation of Code [CWE-94], commonly referred to as code injection. The InstaWP Connect plugin fails to properly sanitize or validate input before it is passed to a code-execution context within PHP. As a result, attacker-controlled data can be interpreted as executable code inside the WordPress runtime.

Exploitation requires network access to the WordPress site and a low-privileged authenticated session. No user interaction is needed to trigger the flaw once the attacker reaches the vulnerable endpoint. Because execution occurs in the context of the PHP process serving WordPress, an attacker can read or modify database records, drop web shells, pivot to other services, or persist on the host.

The EPSS score of 0.681% reflects a moderate probability of exploitation activity relative to other CVEs published in the same window.

Root Cause

The plugin accepts request data that flows into a PHP function capable of evaluating strings as code, without sufficient validation, allow-listing, or type enforcement. This design permits attackers to smuggle PHP syntax through parameters that the plugin then executes.

Attack Vector

The attack originates over the network against WordPress endpoints exposed by the plugin. An authenticated user account with minimal privileges is sufficient. The attacker submits a crafted HTTP request containing PHP payloads to the vulnerable handler. The plugin evaluates the payload server-side, granting the attacker code execution under the web server user.

No verified public proof-of-concept is available. See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-25918

Indicators of Compromise

• Unexpected PHP files or web shells appearing under the wp-content/plugins/instawp-connect/ directory or elsewhere in the WordPress installation
• HTTP POST requests to InstaWP Connect endpoints containing PHP language constructs such as system(, eval(, base64_decode(, or passthru(
• New administrator accounts or modified WordPress user roles that do not correspond to legitimate activity
• Outbound connections from the web server to attacker-controlled infrastructure shortly after requests to plugin endpoints

Detection Strategies

• Inspect WordPress access.log and PHP error logs for requests to InstaWP Connect handlers containing suspicious query parameters or POST bodies
• Monitor file integrity on the wp-content/plugins/ and wp-content/uploads/ directories to detect unauthorized file writes
• Alert on PHP processes spawning shell interpreters (sh, bash, cmd.exe) or executing network utilities such as curl, wget, or nc

Monitoring Recommendations

• Enable verbose WordPress and web server logging, and forward events to a centralized SIEM for correlation
• Track authenticated session activity for low-privileged accounts issuing requests to plugin administrative endpoints
• Baseline normal outbound traffic from the WordPress host and alert on deviations following plugin interactions

How to Mitigate CVE-2024-25918

Immediate Actions Required

• Update the InstaWP Connect plugin to a version later than 0.1.0.8 as soon as a fixed release is available from the vendor
• Audit WordPress user accounts and revoke or reset credentials for accounts that are not strictly required
• Review the WordPress installation for unauthorized files, plugins, themes, or scheduled tasks (wp-cron entries)
• Rotate WordPress secrets in wp-config.php and database credentials if compromise is suspected

Patch Information

Refer to the Patchstack Analysis of InstaWP Connect for the current patch status and vendor-recommended version. Apply the fixed release from the WordPress plugin repository once available and validate the plugin version after the update.

Workarounds

• Deactivate and remove the InstaWP Connect plugin until a patched version can be installed
• Restrict access to the WordPress admin surface using IP allow-listing at the web server or WAF layer
• Deploy a WAF rule that blocks HTTP request bodies containing PHP tokens such as <?php, eval(, or system( targeting plugin endpoints
• Enforce least-privilege on WordPress roles so that only trusted administrators retain elevated capabilities

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate instawp-connect
wp plugin delete instawp-connect

# Verify no residual files remain
find wp-content/plugins -maxdepth 1 -name 'instawp-connect*'