CVE-2023-3956

CVE-2023-3956 is a critical vulnerability affecting the InstaWP Connect plugin for WordPress, specifically versions up to and including 0.0.9.18. It stems from a missing capability check in the 'events_receiver' function, allowing unauthenticated attackers to gain extensive control over affected WordPress sites. With a CVSS score of 9.8, this flaw enables unauthorized data access, modification, and deletion, including the ability to manage posts, plugins, customizer settings, and even create or modify administrator users. While the vulnerability is severe and easily exploitable over the network with low attack complexity, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.