InstaWP Connect - Missing Authorization (CVE-2024-4898)

CVE-2024-4898 is a critical vulnerability in the InstaWP Connect – 1-click WP Staging & Migration WordPress plugin that allows unauthenticated attackers to exploit missing authorization checks in REST API calls. This flaw enables remote attackers to edit arbitrary site options, connect the site to external APIs, and even create new administrator accounts, potentially leading to full site compromise.

CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.

CrowdSec network data shows that most actors exploiting CVE-2024-4898 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-4898 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit unauthenticated POST requests to the /wp-json/instawp-connect/v1/config REST API endpoint, supplying crafted JSON payloads to create new administrator accounts or modify site options.