CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.

• CWE-434

• https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.3.4/includes/class-instawp-tools.php#L105
• https://plugins.trac.wordpress.org/changeset/3634049/instawp-connect
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f5319467-92f6-4d4f-a76a-12aeb25d3c6b?source=cve

Published

Aug 11, 2026

Last Modified

Aug 12, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13448IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains a…9.8
• CVE-2026-13449IBM Business Automation Manager Open Editions 9.0.0 through …9.1
• CVE-2026-1345IBM Verify Identity Access Container 11.0 through 11.0.2 and…7.3
• CVE-2026-13450The GamiPress – Gamification plugin to reward points, achiev…5.3
• CVE-2026-13454The MotoPress Appointment Booking plugin for WordPress is vu…6.5
• CVE-2026-13455PostgreSQL Anonymizer contains a vulnerability that allows u…4.3
• CVE-2026-13458The GenerateBlocks plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-13459The JetFormBuilder — Dynamic Blocks Form Builder plugin for …5.3
• CVE-2026-1346IBM Verify Identity Access Container 11.0 through 11.0.2 and…7.8
• CVE-2026-13461When coupled with the SSL bypass vulnerability, JavaScript c…9.6
• CVE-2026-13462PayRange Android app, version 7.0.7 and below, contains an S…7.5
• CVE-2026-13463IBM Cloud Pak System 2.3.5.0 could allow a local attacker to…7.5