CVSS 3.1 Score 9.8 of 10 (high)


Published Jul 27, 2023
Updated: Nov 7, 2023
CWE ID 862


CVE-2023-3956 is a critical vulnerability in the InstaWP Connect plugin for WordPress, affecting versions up to and including This vulnerability allows unauthenticated attackers to gain unauthorized access, modify or delete data, and perform various actions such as adding or deleting posts and taxonomies, installing or deactivating plugins, changing customizer settings, and modifying or deleting users (including administrator users). The vulnerability stems from a missing capability check in the 'events_receiver' function. Organizations using the affected versions of this plugin are at risk of data breaches, unauthorized modifications, and potential loss of data. To remediate this vulnerability, it is recommended to update the InstaWP Connect plugin to a patched version as soon as it becomes available.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-3956 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options