EUVD-2026-56930
GHSA-f2vh-3ghc-c5xc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects mandatory non-default Apache directory listing and time-limited migration window; no integrity or availability impact per description.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.
Articles & Coverage 3
AnalysisAI
Unauthenticated credential theft in the InstaWP Connect WordPress migration plugin (all versions ≤ 0.1.3.6) exposes database access details and API signatures on Apache servers during active migration windows. The plugin predictably derives its AES-256-CBC decryption passphrase as SHA256(migrate_key), where the migrate_key is directly leaked in the filename of the unprotected options file via Apache directory listing - allowing an attacker who finds the file to mathematically recover the encryption key and decrypt the options payload without any brute force. Recovery of the api_signature may enable downstream remote code execution via InstaWP's service API. No public exploit or CISA KEV listing has been confirmed at time of analysis, though the deterministic key derivation significantly reduces exploitation effort.
Technical ContextAI
InstaWP Connect is a WordPress plugin providing one-click staging and site migration. During migration, the plugin serializes and AES-256-CBC encrypts configuration including database credentials and an API signature into a plaintext file named options-{migrate_key}.txt, stored in the web-accessible directory wp-content/instawpbackups/. Critically, the passphrase for AES-256-CBC decryption is computed as SHA256(migrate_key) - the same 40-character string visible in the filename. Because no index.php or .htaccess is deployed to suppress directory listing, any Apache server with Options +Indexes enabled will serve a browsable directory that exposes the migrate_key directly in the filename listing. The assigned CWE-434 (Unrestricted File Upload with Dangerous Type) is a likely miscategorization; the root weakness is more precisely CWE-548 (Information Exposure Through Directory Listing) compounded by CWE-321 (Use of Hard-coded Cryptographic Key) in the sense that the key derivation is deterministic and tied to publicly exposed data. The vulnerability was identified by Wordfence and confirmed in source code at class-instawp-tools.php line 105 in the 0.1.3.4 tag.
RemediationAI
Update the InstaWP Connect plugin to a version incorporating SVN changeset 3634049 (plugins.trac.wordpress.org/changeset/3634049/instawp-connect), which is the upstream fix confirmed by Wordfence and the plugin repository. If an immediate update is not possible, two compensating controls can close the exposure window independently: first, add an .htaccess file containing 'Options -Indexes' to the wp-content/instawpbackups/ directory to suppress directory listing (this prevents the migrate_key from being read from the filename, breaking the attack chain at the first step); second, add an empty index.php to the same directory (a common WordPress hardening measure that causes Apache to serve a blank page instead of a listing). Either control is sufficient to block exploitation, but neither eliminates the underlying insecure key derivation flaw - the patch remains necessary for full remediation. Administrators should also verify that Apache's global or vhost configuration does not override per-directory .htaccess with AllowOverride None, which would silently neuter the .htaccess mitigation. Additional details and the Wordfence threat intelligence entry are available at wordfence.com/threat-intel/vulnerabilities/id/f5319467-92f6-4d4f-a76a-12aeb25d3c6b.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today