HomeWordPress vulnerabilitiesInstaWP Connect
InstaWP Connect vulnerabilities
InstaWP Connect has 7 known vulnerabilities in this database. The most recent published record is dated 11 Aug 2026.
- Known vulnerabilities
- 7
- Active installs
- 40,000+
- Latest version
- 0.1.4.1
- Last updated
- 29 Sep 2026
- Most recent
- 11 Aug 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Remote code execution CVE-2026-13457 | High 7.5 | Up to 0.1.3.6 | Fixed in a later version (latest 0.1.4.1) | 11 Aug 2026 |
| Remote code execution CVE-2025-2636 | High 8.1 | Up to 0.1.0.85 | Fixed in a later version (latest 0.1.4.1) | 11 Apr 2025 |
| Cross-site request forgery (CSRF) CVE-2024-13913 | High 8.8 | Up to 0.1.0.83 | Fixed in a later version (latest 0.1.4.1) | 14 Mar 2025 |
| Cross-site request forgery (CSRF) CVE-2024-6397 | Critical 9.8 | Before 0.1.0.45 | Fixed in 0.1.0.45 | 11 Jul 2024 |
| Broken access control CVE-2024-4898 | Critical 9.8 | Before 0.1.0.39 | Fixed in 0.1.0.39 | 12 Jun 2024 |
| Arbitrary file upload CVE-2024-2667 | Critical 9.8 | Before 0.1.0.23 | Fixed in 0.1.0.23 | 2 May 2024 |
| Broken access control CVE-2023-3956 | Critical 9.8 | Up to 0.0.9.18 | Fixed in a later version (latest 0.1.4.1) | 27 Jul 2023 |
Read the published descriptions
- CVE-2026-13457, 11 Aug 2026
- The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period. CVE record
- CVE-2025-2636, 11 Apr 2025
- The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file types can be uploaded and included, or are already present on the filesystem locally. There are currently no known vulnerabilities in this plugin that make file upload possible, meaning this won't be exploitable to achieve remote code execution on most instances with just this plugin alone. Another vulnerability would need to be present on the site allowing arbitrary file upload in order to leverage this to achieve remote code execution. CVE record
- CVE-2024-13913, 14 Mar 2025
- The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. CVE record
- CVE-2024-6397, 11 Jul 2024
- The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery. CVE record
- CVE-2024-4898, 12 Jun 2024
- The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts. CVE record
- CVE-2024-2667, 2 May 2024
- The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for unauthenticated attackers to upload arbitrary files. CVE record
- CVE-2023-3956, 27 Jul 2023
- The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plugin, change customizer settings, add or modify or delete user including administrator user. CVE record
What to do if you run InstaWP Connect
If you run InstaWP Connect, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new InstaWP Connect vulnerabilities
Free. We email you when a new vulnerability is published for InstaWP Connect, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.