CVE-2024-2667: InstaWP Connect Auth Bypass Vulnerability

CVE-2024-2667 Overview

CVE-2024-2667 is a critical arbitrary file upload vulnerability affecting the InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress. The vulnerability exists due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This flaw makes it possible for unauthenticated attackers to upload arbitrary files to vulnerable WordPress installations, potentially leading to complete site compromise.

Critical Impact

Unauthenticated attackers can upload malicious files including PHP webshells to WordPress sites, enabling remote code execution and full server compromise without any authentication.

Affected Products

• InstaWP Connect WordPress Plugin versions up to and including 0.1.0.22
• WordPress installations using vulnerable InstaWP Connect plugin versions
• Websites utilizing InstaWP staging and migration functionality

Discovery Timeline

• May 2, 2024 - CVE-2024-2667 published to NVD
• February 6, 2025 - Last updated in NVD database

Technical Details for CVE-2024-2667

Vulnerability Analysis

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), representing a severe security flaw in web application file handling. The InstaWP Connect plugin exposes a REST API endpoint at /wp-json/instawp-connect/v1/config that accepts file uploads without proper authentication or file type validation.

The core issue is that the endpoint fails to verify that uploaded files are safe content types, allowing attackers to upload executable PHP files. When combined with the lack of authentication requirements, this creates a direct path for unauthenticated remote code execution. An attacker can upload a PHP webshell and then access it directly via the web server, gaining command execution capabilities on the underlying system.

Root Cause

The root cause of CVE-2024-2667 is insufficient file validation in the plugin's REST API endpoint handler. The /wp-json/instawp-connect/v1/config endpoint was designed to handle configuration data but lacked proper security controls including:

• No authentication check to verify the requester has appropriate permissions
• Missing file type validation to ensure only safe file types are processed
• Absence of content inspection to detect malicious payloads
• No restriction on executable file extensions like .php

Attack Vector

The attack vector for this vulnerability is network-based, requiring no user interaction or prior authentication. An attacker can exploit this vulnerability by:

1. Identifying a WordPress site running a vulnerable version of InstaWP Connect
2. Sending a crafted HTTP request to the /wp-json/instawp-connect/v1/config REST API endpoint
3. Including a malicious PHP file (such as a webshell) in the upload payload
4. Accessing the uploaded file directly via its web-accessible path
5. Executing arbitrary commands on the server through the uploaded webshell

The vulnerability manifests in the REST API endpoint's file handling mechanism. The endpoint accepts configuration data via HTTP requests but fails to validate the content type or sanitize uploaded files. For detailed technical analysis of the exploitation mechanism, refer to the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-2667

Indicators of Compromise

• Unexpected PHP files in WordPress upload directories or plugin folders
• Web server access logs showing POST requests to /wp-json/instawp-connect/v1/config from unknown sources
• Presence of webshell files with suspicious names or obfuscated PHP code
• Unusual outbound network connections from the web server
• New or modified files with recent timestamps in the InstaWP Connect plugin directory

Detection Strategies

• Monitor web server logs for POST requests targeting the /wp-json/instawp-connect/v1/config endpoint
• Implement file integrity monitoring (FIM) to detect unauthorized file uploads or modifications
• Deploy web application firewall (WAF) rules to block suspicious file upload attempts
• Scan WordPress installations for known webshell signatures and malicious PHP patterns
• Review REST API access patterns for anomalous unauthenticated requests

Monitoring Recommendations

• Enable detailed logging for WordPress REST API endpoints
• Set up alerts for new file creation events in web-accessible directories
• Monitor for unusual PHP process execution or command shell spawning
• Implement network traffic analysis to detect command and control communications
• Regularly audit installed WordPress plugin versions against known vulnerability databases

How to Mitigate CVE-2024-2667

Immediate Actions Required

• Update InstaWP Connect plugin to a version newer than 0.1.0.22 immediately
• Review WordPress installations for signs of compromise or unauthorized file uploads
• Remove any suspicious PHP files found in upload directories or plugin folders
• Temporarily disable the InstaWP Connect plugin if immediate patching is not possible
• Implement WAF rules to block requests to the vulnerable endpoint until patched

Patch Information

The vulnerability has been addressed in versions released after 0.1.0.22. Administrators should update to the latest available version of the InstaWP Connect plugin through the WordPress plugin repository. The security fix can be reviewed in the WordPress Plugin Changeset.

Workarounds

• Disable the InstaWP Connect plugin until it can be updated to a patched version
• Implement server-side firewall rules to block access to the vulnerable REST API endpoint
• Use .htaccess or web server configuration to deny access to /wp-json/instawp-connect/v1/config
• Deploy a web application firewall with rules to detect and block arbitrary file upload attempts
• Restrict REST API access to authenticated users only via WordPress security plugins

# Apache .htaccess workaround to block vulnerable endpoint
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/instawp-connect/v1/config [NC]
RewriteRule .* - [F,L]
</IfModule>