EUVD-2026-57915
GHSA-3mrh-8jqh-26mj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible plugin endpoint requires no privileges or user interaction; integrity-only impact with no confidentiality or availability consequence confirmed by description.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
AnalysisAI
Broken access control in InstaWP Connect (WordPress plugin) versions up to and including 0.1.3.7 permits unauthenticated remote attackers to perform restricted actions without authorization, resulting in limited integrity impact on the target WordPress installation. The root cause is CWE-862 (Missing Authorization), where one or more plugin endpoints fail to verify the requester's permissions before executing sensitive operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration is required beyond the plugin being installed and active on a publicly reachable WordPress site running InstaWP Connect version 0.1.3.7 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 5.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N, UI:N) flaw with unchanged scope (S:U) and limited integrity-only impact (I:L, C:N, A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker discovers a WordPress site with the InstaWP Connect plugin installed by fingerprinting the plugin via standard enumeration techniques. The attacker then crafts an HTTP request directly targeting the unprotected plugin endpoint - requiring no session token or nonce - and triggers a restricted action such as modifying plugin configuration or initiating a site connection event, achieving low-level integrity impact without any credentials. … |
| Remediation | The primary remediation is to update the InstaWP Connect plugin beyond version 0.1.3.7; however, no specific fixed release version has been confirmed in the available data - administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-3-7-broken-access-control-vulnerability for the latest patched release before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Instawp Connect
View allThe InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to
The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due
The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all
The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of
InstaWP Connect WordPress plugin through version 0.1.2.5 permits authenticated users to access or modify resources they
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today