Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · instawp-connect
InstaWP Connect
19 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 25, 2026InstaWP Connect: Does not perform a capability check on its InstaWP Connect WordPress plugin before 0CVE-2026-114743 · fixed in 0.1.4.2 · reported by WPScanLow 3.1
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.
Oct 16, 2026InstaWP Connect – 1-click WP Staging & Migration: Privilege EscalationCVE-2026-109400 · affects up to 0.1.4.1 · reported by WordfenceHigh 7.5
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role t
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.CVE-2026-73401 · affects up to 0.1.3.7 · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
Aug 11, 2026InstaWP Connect – 1-click WP Staging & Migration: Remote Code ExecutionCVE-2026-13457 · affects up to 0.1.3.6 · reported by WordfenceHigh 7.5
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026InstaWP Connect: Missing AuthorizationCVE-2026-39504 · affects up to 0.1.2.5 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.2.5.
Dec 18, 2025InstaWP Connect: Missing AuthorizationCVE-2025-66068 · affects up to 0.1.1.9 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.1.9.
Apr 11, 2025InstaWP Connect – 1-click WP Staging & Migration: Local File InclusionCVE-2025-2636 · affects up to 0.1.0.85 · reported by WordfenceHigh 8.1
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file types can be uploaded and included, or are already present on the filesystem locally. There are currently no known vulnerabilities in this plugin that make file upload possible, meaning this won't be exploitable to achieve remote code execution on most instances with just this plugin alone. Another vulnerability would need to be present on the site allowing arbitrary file upload in order to leverage this to achieve remote code execution.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 31, 2025InstaWP Connect: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31387 · affects up to 0.1.0.82 · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InstaWP InstaWP Connect instawp-connect allows PHP Local File Inclusion.This issue affects InstaWP Connect: from n/a through <= 0.1.0.82.
Mar 14, 2025InstaWP Connect – 1-click WP Staging & Migration: Cross-Site Request ForgeryCVE-2024-13913 · affects up to 0.1.0.83 · reported by WordfenceHigh 8.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2024InstaWP Connect – 1-click WP Staging & Migration: Authentication bypassCVE-2024-6397 · affects up to 0.1.0.44 · fixed in 0.1.0.44 · reported by WordfenceCritical 9.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 24, 2024InstaWP Connect: Unrestricted Upload of File with Dangerous TypeCVE-2024-37228 · affects up to 0.1.0.38 · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.38.
Jun 12, 2024InstaWP Connect – 1-click WP Staging & Migration: Arbitrary option updatesCVE-2024-4898 · affects up to 0.1.0.38 · reported by WordfenceCritical 9.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.
Jun 9, 2024InstaWP Connect: Missing AuthorizationCVE-2024-32701 · affects up to 0.1.0.24 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.24.
May 17, 2024InstaWP Connect: Incorrect Privilege AssignmentCVE-2024-22145 · affects up to 0.1.0.8 · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8.
May 2, 2024InstaWP Connect – 1-click WP Staging & Migration: Arbitrary file uploadsCVE-2024-2667 · affects up to 0.1.0.22 · reported by WordfenceCritical 9.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for unauthenticated attackers to upload arbitrary files.
Apr 3, 2024InstaWP Connect: Improper Control of Generation of Code ('Code Injection')CVE-2024-25918 · affects up to 0.1.0.8 · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8.
Jan 31, 2024InstaWP Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-23507 · affects up to 0.1.0.9 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.
Jan 26, 2024InstaWP Connect: Insertion of Sensitive Information Into Sent DataCVE-2024-23506 · affects up to 0.1.0.9 · reported by PatchstackHigh 7.7
Insertion of Sensitive Information Into Sent Data vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.
Jul 27, 2023InstaWP Connect: Unauthorized access of data, modification of data and loss of dataCVE-2023-3956 · affects up to 0.0.9.18 · reported by WordfenceCritical 9.8
The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plugin, change customizer settings, add or modify or delete user including administrator user.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.