CVE-2024-4898

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - 認証欠如による未認証APIセットアップ/任意オプション更新/管理者ユーザー作成...

InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...

WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – ワンクリックのWP Staging & Migration = 0.1.0.38 - 未認証のAPIセットアップ/任意オプションの更新/管理者ユーザーの作成に対する認可の欠如...

CVE-2024-22145

CVE-2024-22145 InstaWP Connect = 0.1.0.8 - 任意のオプション更新における認可不足（購読者以上） 説明: WordPress用プラグイン「InstaWP Connect – 1-click WP Staging & Migration」は、バージョン0.1.0.8以前において、savemanagementsettings関数に対する capability チェックが欠如しているため、データの不正な改変に対して脆弱です。これにより、認証された攻撃者（購読者以上のアクセス権を持つ）が、変更する root@kitploit: Severity: high...

CVE-2024-2667

InstaWP Connect – 1クリックWPステージング＆マイグレーション 有効または無効なAPIキーを自由に使用できます。\ overridepluginzip - バックドアを含む悪意のあるWordPressプラグインが格納されたzipファイルへのパス。 インポート後、http://victim-domain/wp-content/plugins/malicious-plugin/backdoor.php からバックドアにアクセスできます（ディレクトリ名がmalicious-pluginで、そのディレクトリ配下にbackdoor.phpがある場合）。 参照:...

CVE-2024-2667-Poc

CVE-2024-2667-Poc 🚀 説明 WordPress用プラグイン「InstaWP Connect – 1-click WP Staging & Migration」は、/wp-json/instawp-connect/v1/config REST APIエンドポイントにおけるファイル検証が不十分なため、バージョン0.1.0.22以前の全バージョンにおいて任意ファイルのアップロードが可能です。これにより、認証されていない攻撃者が任意のファイルをアップロードできる可能性があります。 スクリプト使用ガイド ⚙️ 要件のインストール...

CVE-2026-73401

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

CVE-2026-73401

CVE-2026-73401 affects the WordPress InstaWP Connect plugin (versions

CVE-2026-73401 WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

EUVD-2026-57915

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by rajukani100 in WordPress Plugin InstaWP Connect versions = 0.1.3.7...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthenticated cryptographic key disclosure and potential RCE in all versions up to and including 0.1.3.6. The root cause is storing an encrypted options file as options-{migrate_key}.txt in wp-content/ins...

CVE-2026-13457 InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457 InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

EUVD-2026-56930

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

WordPress InstaWP Connect plugin <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure vulnerability

Unauthenticated Cryptographic Key Disclosure vulnerability discovered by 0xsabre in WordPress Plugin InstaWP Connect versions = 0.1.3.6...

PT-2026-70886

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migrate key.txt in...