CVE-2024-22145 is an Incorrect Privilege Assignment vulnerability found in the InstaWP Connect WordPress plugin, affecting versions up to and including 0.1.0.8. This high-severity flaw (CVSS 8.8) allows a low-privileged attacker to remotely compromise confidentiality, integrity, and availability with low complexity and no user interaction. Although not yet in CISA's KEV catalog, it is on an active "Hot List" and possesses a very high EPSS score, suggesting a significant probability of future exploitation. Currently, there is no public exploit code available in common databases, but the vulnerability has generated some community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 0.1.0.8CPE match | cpe:2.3:a:instawp:instawp_connect:*:*:*:*:*:wordpress:*:* | ||
< 0.1.0.9CPE matchmatch criteria | cpe:2.3:a:instawp:instawp_connect:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.