WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...

CVE-2024-4898

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...

CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...

CVE-2024-22145

CVE-2024-22145 InstaWP Connect = 0.1.0.8 - Missing Authorization to Arbitrary Options Update Subscriber+ Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2024-2667

InstaWP Connect – 一键WP暂存与迁移 您可以使用任何有效或无效的API密钥。 overridepluginzip - 包含带有后门的恶意WordPress插件的zip文件路径。 导入后，您可以通过 http://victim-domain/wp-content/plugins/malicious-plugin/backdoor.php 访问后门（假设目录名为malicious-plugin且backdoor.php位于该目录下）。 参考文献：...

CVE-2024-2667-Poc

CVE-2024-2667-Poc 🚀 Descrizione Il plugin InstaWP Connect – 1-click WP Staging & Migration per WordPress è vulnerabile a caricamenti arbitrari di file a causa di una validazione insufficiente dei file nell'endpoint REST API /wp-json/instawp-connect/v1/config in tutte le versioni fino alla 0.1.0.2...

CVE-2026-73401

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

CVE-2026-73401

CVE-2026-73401 affects the WordPress InstaWP Connect plugin (versions

EUVD-2026-57915

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

CVE-2026-73401 WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by rajukani100 in WordPress Plugin InstaWP Connect versions = 0.1.3.7...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457 InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthenticated cryptographic key disclosure and potential RCE in all versions up to and including 0.1.3.6. The root cause is storing an encrypted options file as options-{migrate_key}.txt in wp-content/ins...

CVE-2026-13457 InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

EUVD-2026-56930

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

WordPress InstaWP Connect plugin <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure vulnerability

Unauthenticated Cryptographic Key Disclosure vulnerability discovered by 0xsabre in WordPress Plugin InstaWP Connect versions = 0.1.3.6...

PT-2026-70886

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migrate key.txt in...