Advisories · Technology

InstaWP Connect – 1-click WP Staging & Migration.

Every CVE that names InstaWP Connect – 1-click WP Staging & Migration among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-109400 CVE record

CVSS 7.5 High

InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
- InstaWP Connect – 1-click WP Staging & Migration
- Privilege escalation
Not analysed yet 16 Oct 2026
CVE-2026-13457 CVE record

CVSS 7.5 High

InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure
- InstaWP Connect – 1-click WP Staging & Migration
- Unrestricted file upload
Not analysed yet 11 Aug 2026
CVE-2025-2636 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion
- InstaWP Connect – 1-click WP Staging & Migration
- Path traversal
Not analysed yet 11 Apr 2025
CVE-2024-13913 CVE record

CVSS 8.8 High

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion
- InstaWP Connect – 1-click WP Staging & Migration
- Cross-site request forgery (CSRF)
Not analysed yet 14 Mar 2025
CVE-2024-6397 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin
- InstaWP Connect – 1-click WP Staging & Migration
- Authentication bypass
Not analysed yet 11 Jul 2024
CVE-2024-4898 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
- InstaWP Connect – 1-click WP Staging & Migration
- Broken access control
Not analysed yet 12 Jun 2024
CVE-2024-2667 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
- InstaWP Connect – 1-click WP Staging & Migration
- Unrestricted file upload
Not analysed yet 2 May 2024
CVE-2023-3956 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver
- InstaWP Connect – 1-click WP Staging & Migration
- Broken access control
Not analysed yet 27 Jul 2023