CVE-2024-37228: InstaWP Connect File Upload Vulnerability

CVE-2024-37228 Overview

CVE-2024-37228 is an unrestricted file upload vulnerability in the InstaWP Connect plugin for WordPress. The flaw affects all versions of instawp-connect from initial release through 0.1.0.38. Attackers can upload files with dangerous types to the server without authentication, enabling arbitrary file upload and likely remote code execution on the underlying WordPress host. The vulnerability is tracked under [CWE-434] (Unrestricted Upload of File with Dangerous Type) and is exploitable over the network with no privileges or user interaction required.

Critical Impact
Unauthenticated attackers can upload executable files to WordPress sites running InstaWP Connect ≤ 0.1.0.38, leading to full site compromise.

Affected Products

InstaWP Connect plugin for WordPress, versions up to and including 0.1.0.38
WordPress installations with the instawp-connect plugin enabled
Sites using InstaWP Connect for migration or staging workflows

Discovery Timeline

2024-06-24 - CVE-2024-37228 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-37228

Vulnerability Analysis

The vulnerability resides in the file upload handling logic of the InstaWP Connect plugin. The plugin exposes functionality that accepts file uploads without enforcing restrictions on file type, extension, or MIME content. An unauthenticated remote attacker can submit a crafted HTTP request containing a malicious payload, such as a PHP web shell, and have it written into a web-accessible directory.

Once uploaded, the attacker can request the file directly through the web server to execute arbitrary PHP code. This grants full control over the WordPress installation, including database credentials, administrative accounts, and any data stored on the host. The issue is classified under [CWE-434], which covers software that allows attackers to upload or transfer files of dangerous types that the environment will later process automatically.

Root Cause

The root cause is the absence of server-side validation on uploaded files within InstaWP Connect endpoints. The plugin does not enforce allow-listed extensions, verify MIME types against file content, or require authenticated requests for the upload handler. Combined, these gaps let an attacker bypass intended controls and place executable PHP files inside the WordPress directory structure.

Attack Vector

Exploitation requires only network access to the WordPress site. The attacker sends an HTTP POST request to the vulnerable plugin endpoint with a malicious file in the multipart body. Because authentication is not required, mass scanning and automated exploitation are feasible. The Patchstack advisory documents the upload primitive and the affected request flow. See the Patchstack WordPress Plugin Vulnerability entry for technical details.

No verified public proof-of-concept code is referenced in the available sources, so exploitation specifics are described in prose rather than reproduced here.

Detection Methods for CVE-2024-37228

Indicators of Compromise

New PHP files appearing under wp-content/uploads/ or plugin directories with recent modification timestamps
Outbound connections from the web server to unfamiliar hosts following inbound POST requests to InstaWP Connect endpoints
WordPress admin users or options created shortly after suspicious upload requests
Web shell signatures such as eval(, base64_decode(, or system( in files under the WordPress document root

Detection Strategies

Inspect web server access logs for unauthenticated POST requests targeting instawp-connect plugin paths
Monitor file system changes to plugin and upload directories for newly created .php, .phtml, or .phar files
Correlate file write events with subsequent GET requests to the same path, which indicates web shell execution
Run YARA scans across the WordPress installation for common PHP web shell patterns

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation, focused on wp-content/ and wp-includes/
Forward web server and PHP error logs to a centralized analytics platform for retroactive hunting
Alert on PHP process executions spawned by the web server user, which often indicate web shell activity
Track plugin version inventories across all WordPress sites to identify unpatched instawp-connect installs

How to Mitigate CVE-2024-37228

Immediate Actions Required

Update InstaWP Connect to a version newer than 0.1.0.38 immediately
If a patched version is not yet deployed, deactivate and remove the instawp-connect plugin
Audit wp-content/uploads/ and plugin directories for unexpected PHP files and remove any web shells
Rotate WordPress administrator credentials, database passwords, and API keys on any potentially affected site

Patch Information

Vendor remediation details are tracked in the Patchstack Instawp Connect Advisory. Administrators should upgrade past version 0.1.0.38 using the WordPress plugin updater or by replacing the plugin directory with the patched release.

Workarounds

Block public access to InstaWP Connect endpoints at the web application firewall until patching is complete
Restrict execution of PHP files within wp-content/uploads/ using web server configuration
Require IP allow-listing for any administrative or migration interfaces exposed by the plugin
Disable the plugin entirely on production sites where InstaWP migration functionality is not actively needed

bash

# Example Apache configuration to block PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>