CVE-2026-13457: Unrestricted Upload of File with Dangerous Type

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...