Description
WordPress InstaWP Connect 插件存在文件上传漏洞，攻击者可以通过向 /?rest_route=/instawp-connect/v1/config 发送特制的请求，利用该漏洞上传恶意文件，从而可能导致服务器被完全控制，敏感信息泄露等严重后果。
WordPress InstaWP Connect 插件 / rest_route 文件上传漏洞（CVE-2024-2667）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-2667
https://www.wordfence.com/threat-intel/vulnerabilities/id/f6aead8d-c136-4952-ad03-86fe0f144dea
https://github.com/Nxploited/CVE-2024-2667-Poc
https://vulners.com/cve/CVE-2024-2667
https://www.cve.org/CVERecord?id=CVE-2024-2667
https://patchstack.com/database/wordpress/plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-0-22-unauthenticated-arbitrary-file-upload-vulnerability
https://juejin.cn/post/7626941943554818084
https://pentest-tools.com/vulnerabilities-exploits/instawp-connect-01022-unauthenticated-arbitrary-file-upload_27159
https://hackhalt.com/threat/cve-2024-2667/