CVE-2024-4898 InstaWP Connect – 一键WP临时环境与迁移 <= 0.1.0.38 - 缺少对未认证API设置/任意选项更新/管理员用户创建的授权 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/instawp-connect/instawp-connect-1-click-wp-staging-migration-01038-missing-authorization-to-unauthenticated-api-setuparbitrary-options-updateadministrative-user-creation
文件: wp-content/plugins/instawp-connect/includes/class-instawp-rest-api.php image image image
文件: wp-content/plugins/instawp-connect/includes/class-instawp-tools.php image
创建管理员用户角色
创建API密钥: https://app.instawp.io/user/api-tokens image
