CVE-2024-37228: InstaWP Connect File Upload Vulnerability

CVE-2024-37228 Overview

CVE-2024-37228 is an unrestricted file upload vulnerability in the InstaWP Connect plugin for WordPress. The flaw affects all versions of instawp-connect from initial release through 0.1.0.38. Attackers can upload files with dangerous types to the server without authentication, enabling arbitrary file upload and likely remote code execution on the underlying WordPress host. The vulnerability is tracked under [CWE-434] (Unrestricted Upload of File with Dangerous Type) and is exploitable over the network with no privileges or user interaction required.

Critical Impact

Unauthenticated attackers can upload executable files to WordPress sites running InstaWP Connect ≤ 0.1.0.38, leading to full site compromise.

Affected Products

• InstaWP Connect plugin for WordPress, versions up to and including 0.1.0.38
• WordPress installations with the instawp-connect plugin enabled
• Sites using InstaWP Connect for migration or staging workflows

Discovery Timeline

• 2024-06-24 - CVE-2024-37228 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-37228

Vulnerability Analysis

The vulnerability resides in the file upload handling logic of the InstaWP Connect plugin. The plugin exposes functionality that accepts file uploads without enforcing restrictions on file type, extension, or MIME content. An unauthenticated remote attacker can submit a crafted HTTP request containing a malicious payload, such as a PHP web shell, and have it written into a web-accessible directory.

Once uploaded, the attacker can request the file directly through the web server to execute arbitrary PHP code. This grants full control over the WordPress installation, including database credentials, administrative accounts, and any data stored on the host. The issue is classified under [CWE-434], which covers software that allows attackers to upload or transfer files of dangerous types that the environment will later process automatically.

Root Cause

The root cause is the absence of server-side validation on uploaded files within InstaWP Connect endpoints. The plugin does not enforce allow-listed extensions, verify MIME types against file content, or require authenticated requests for the upload handler. Combined, these gaps let an attacker bypass intended controls and place executable PHP files inside the WordPress directory structure.

Attack Vector

Exploitation requires only network access to the WordPress site. The attacker sends an HTTP POST request to the vulnerable plugin endpoint with a malicious file in the multipart body. Because authentication is not required, mass scanning and automated exploitation are feasible. The Patchstack advisory documents the upload primitive and the affected request flow. See the Patchstack WordPress Plugin Vulnerability entry for technical details.

No verified public proof-of-concept code is referenced in the available sources, so exploitation specifics are described in prose rather than reproduced here.

Detection Methods for CVE-2024-37228

Indicators of Compromise

• New PHP files appearing under wp-content/uploads/ or plugin directories with recent modification timestamps
• Outbound connections from the web server to unfamiliar hosts following inbound POST requests to InstaWP Connect endpoints
• WordPress admin users or options created shortly after suspicious upload requests
• Web shell signatures such as eval(, base64_decode(, or system( in files under the WordPress document root

Detection Strategies

• Inspect web server access logs for unauthenticated POST requests targeting instawp-connect plugin paths
• Monitor file system changes to plugin and upload directories for newly created .php, .phtml, or .phar files
• Correlate file write events with subsequent GET requests to the same path, which indicates web shell execution
• Run YARA scans across the WordPress installation for common PHP web shell patterns

Monitoring Recommendations

• Enable file integrity monitoring on the WordPress installation, focused on wp-content/ and wp-includes/
• Forward web server and PHP error logs to a centralized analytics platform for retroactive hunting
• Alert on PHP process executions spawned by the web server user, which often indicate web shell activity
• Track plugin version inventories across all WordPress sites to identify unpatched instawp-connect installs

How to Mitigate CVE-2024-37228

Immediate Actions Required

• Update InstaWP Connect to a version newer than 0.1.0.38 immediately
• If a patched version is not yet deployed, deactivate and remove the instawp-connect plugin
• Audit wp-content/uploads/ and plugin directories for unexpected PHP files and remove any web shells
• Rotate WordPress administrator credentials, database passwords, and API keys on any potentially affected site

Patch Information

Vendor remediation details are tracked in the Patchstack Instawp Connect Advisory. Administrators should upgrade past version 0.1.0.38 using the WordPress plugin updater or by replacing the plugin directory with the patched release.

Workarounds

• Block public access to InstaWP Connect endpoints at the web application firewall until patching is complete
• Restrict execution of PHP files within wp-content/uploads/ using web server configuration
• Require IP allow-listing for any administrative or migration interfaces exposed by the plugin
• Disable the plugin entirely on production sites where InstaWP migration functionality is not actively needed

# Example Apache configuration to block PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>