Description

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T20:17:26.993Z",
  "pubdate": "2026-08-11T20:17:26.993Z",
  "executiveSummary": "The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress in all versions up to, and including, 0.1.3.6 contains a vulnerability that allows for Remote Code Execution via top-level script functions. The flaw allows unauthenticated attackers to retrieve sensitive configuration data, including database access details and the api_signature, under specific environmental conditions.\nThe primary impact of this vulnerability is the potential exposure of sensitive database credentials and internal API signatures, which can subsequently facilitate full administrative compromise or Remote Code Execution on the underlying WordPress installation. The affected systems are WordPress instances utilizing vulnerable versions of the InstaWP Connect plugin.\nThe risk implications are critical due to the potential exposure of sensitive credentials. However, successful exploitation is constrained by specific environmental prerequisites: the target site must be hosted on an Apache server with directory indexing explicitly enabled (Options +Indexes) on the backup storage directory, and exploitation is temporally limited to the active migration period when the options file resides on the server.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure storage and lack of access control hardening for sensitive migration artifacts. Specifically, the plugin stores its encrypted options file as options-{migrate_key}.txt within the wp-content/instawpbackups/ directory. The plugin fails to deploy protective mechanisms such as an index.php or .htaccess file to prevent directory listing.\nThe vulnerable component is the file storage mechanism utilized during the migration routine in InstaWP Connect versions up to, and including, 0.1.3.6. Authentication and privilege requirements are minimal for the initial reconnaissance phase, as unauthenticated attackers can interact directly with the exposed web-accessible directory if directory indexing is enabled.\nThe attack flow proceeds in a sequential manner. First, an unauthenticated attacker leverages network exposure by browsing to the wp-content/instawpbackups/ directory on target servers running Apache with directory listing enabled (Options +Indexes). Because protective files are absent, the directory listing exposes the 40-character migrate_key contained within the options-{migrate_key}.txt filename.\nSecond, upon obtaining the 40-character migrate_key, the attacker derives the AES-256-CBC passphrase by computing the SHA256 hash of the migrate_key (SHA256(migrate_key)). Third, the attacker downloads and decrypts the options file using the derived passphrase to recover the api_signature and database access details.\nFinally, possessing the database access details and api_signature, the attacker can leverage these credentials to compromise the database or interact with the application logic, ultimately leading to Remote Code Execution during the time-limited migration window."
}