CVE-2026-13457InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure
Updated under an hour ago ()
Does this affect you?
It affects InstaWP Connect – 1-click WP Staging & Migration. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-434
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Wordfence
- NVD analysis
- Deferred
- Record last updated
- Aug 12, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
instawp InstaWP Connect – 1-click WP Staging & Migration instawp:connect_1_click_wp_staging_and_migration (from the name) | through 0.1.3.6 | CNA record |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f5319467-92f6-4d4f-a76a-12aeb25d3c6b?source=cve
- https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.3.4/includes/class-instawp-tools.php#L105
- https://plugins.trac.wordpress.org/changeset/3634049/instawp-connect
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.