CVE-2026-13457

Deferred Deferred - Pending Action

Remote Code Execution in InstaWP Connect WordPress Plugin

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: Wordfence

Description

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-13457

EUVD

EUVD-2026-56930

Affected Vendors & Products

Vendor	Product	Version / Range
instawp	instawp_connect	to 0.1.3.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability in the InstaWP Connect WordPress plugin allows Remote Code Execution due to improper file storage. The plugin saves encrypted options in a backup directory without protection, exposing a 40-character key. Attackers can derive the encryption passphrase, decrypt sensitive data like database credentials, and gain unauthorized access if the server has directory listing enabled.

Detection Guidance

Check if the wp-content/instawpbackups/ directory is accessible via directory listing on Apache servers. Look for files named options-{migrate_key}.txt in that directory. If found, verify if the migrate_key is exposed and if the options file contains sensitive data like api_signature.

Impact Analysis

Unauthenticated attackers could access your WordPress database, steal sensitive data, or execute malicious code on your site. This requires your server to have directory listing enabled for the wp-content/instawpbackups/ directory during the migration period.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection. Unauthorized access to personal or health data may result in legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Disable directory listing in Apache by removing 'Options +Indexes' from the wp-content/instawpbackups/ directory configuration. Update the InstaWP Connect plugin to the latest version beyond 0.1.3.6. Remove any exposed options-{migrate_key}.txt files and rotate the migrate_key and api_signature.

Hi! I’m here to help you understand CVE-2026-13457. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70