CVE-2024-32701: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2024-32701) was discovered in InstaWP Team's InstaWP Connect WordPress plugin, affecting versions through 0.1.0.24. The vulnerability was publicly disclosed on April 22, 2024, and was subsequently fixed in version 0.1.0.25 (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue, which represents a broken access control vulnerability. The CVSS v3.1 scores vary between sources, with NVD assigning a High severity score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while Patchstack rates it as Medium severity with a score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) (NVD).

The vulnerability could allow an unprivileged user to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks (Patchstack).

The vulnerability requires a low attack complexity and network access, with low privileges needed for exploitation. According to Patchstack's assessment, this security issue has a low severity impact and is unlikely to be exploited (Patchstack).

Users are advised to update to InstaWP Connect version 0.1.0.25 or later to remediate this vulnerability. Patchstack users can enable auto-update functionality for vulnerable plugins (Patchstack).