CVE-2024-25918: 
WordPress vulnerability analysis and mitigation

The InstaWP Connect WordPress plugin contains a Remote Code Execution (RCE) vulnerability identified as CVE-2024-25918. This vulnerability affects versions up to and including 0.1.0.8 of the InstaWP Connect plugin, which allows authenticated users with subscriber-level access or higher to perform code injection through unrestricted upload of files with dangerous types (Patchstack, WPScan).

The vulnerability is classified as an Unrestricted Upload of File with Dangerous Type (CWE-434) that enables code injection. It has received a CVSS v3.1 base score of 8.8 (HIGH) from NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Patchstack assigned it a more severe CVSS score of 9.9 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (NVD).

The vulnerability allows authenticated attackers with subscriber-level privileges or higher to execute arbitrary code on the server, potentially leading to complete server compromise. This makes it possible for malicious actors to gain backdoor access and take full control of the affected WordPress website (Patchstack).

The vulnerability is known to be actively exploited in the wild. The attack requires low complexity and can be executed remotely by an authenticated user with low privileges (Patchstack).

Website administrators are strongly advised to update the InstaWP Connect plugin to version 0.1.0.9 or later, which contains the security fix for this vulnerability. Patchstack has also issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).