{"id":"CVE-2026-13457","aliases":["EUVD-2026-56930","GHSA-f2vh-3ghc-c5xc"],"status":"published","title":"InstaWP Connect \u003c= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure","description":"The InstaWP Connect – 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0085,"percentile":0.58603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2026-08-11T19:37:28Z","modified":"2026-08-12T21:00:52Z","products":[{"vendor":"instawp","product":"instawp connect – 1-click wp staging \u0026 migration"},{"vendor":"instawp team","product":"instawp connect – 1-click wp staging \u0026 migration"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5319467-92f6-4d4f-a76a-12aeb25d3c6b?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.3.4/includes/class-instawp-tools.php#L105"},{"url":"https://plugins.trac.wordpress.org/changeset/3634049/instawp-connect"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13457"},{"url":"https://github.com/advisories/GHSA-f2vh-3ghc-c5xc"}],"sources":{"cve":[{"id":"CVE-2026-13457","title":"InstaWP Connect \u003c= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure","description":"The InstaWP Connect – 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.","status":"published","published":"2026-08-11T19:37:28.661Z","modified":"2026-08-12T12:57:54.689Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-56930","description":"The InstaWP Connect – 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.","status":"published","published":"2026-08-11T19:37:28Z","modified":"2026-08-12T12:57:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:58.638592Z"}],"ghsa":[{"id":"GHSA-f2vh-3ghc-c5xc","title":"The InstaWP Connect – 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to Remote...","description":"The InstaWP Connect – 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.","status":"published","published":"2026-08-11T21:33:09Z","modified":"2026-08-11T21:33:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:10:21.509652Z"}],"nvd":[{"id":"CVE-2026-13457","description":"The InstaWP Connect – 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.","status":"published","published":"2026-08-11T20:17:26.993Z","modified":"2026-08-12T21:00:52.257Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:36.880938Z"}]}}