CVE-2024-13913 is a CSRF vulnerability in the InstaWP Connect – 1-click WP Staging & Migration WordPress plugin (up to version 0.1.0.83). The issue arises from missing or incorrect nonce validation in the '/migrate/templates/main.php' endpoint, enabling unauthenticated attackers to perform unauthorized actions. Exploitation can lead to arbitrary file inclusion and execution of PHP code, allowing attackers to bypass access controls and access or manipulate sensitive data. The vulnerability is classified under CWE-352 and carries a CVSS 3.1 base score of 8.8, indicating high severity. No patch or remediation details are currently available from the vendor.

Successful exploitation allows unauthenticated attackers to include and execute arbitrary PHP files on the affected server. This can result in bypassing access controls, unauthorized disclosure of sensitive information, and full code execution on the server hosting the vulnerable plugin. The impact affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.