Instawp Team vulnerabilities

Products

• Connect – 1-click Wp Staging & Migration 8

Newest

• instawp connect – 1-click wp staging & migration InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting CVE-2026-109400 7.5 HighOctober 16, 2026
• instawp connect – 1-click wp staging & migration InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure CVE-2026-13457 7.5 HighAugust 11, 2026
• instawp connect – 1-click wp staging & migration InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion CVE-2025-2636 EPSS 10.6% 8.1 HighApril 11, 2025
• instawp connect – 1-click wp staging & migration InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion CVE-2024-13913 8.8 HighMarch 14, 2025
• instawp connect – 1-click wp staging & migration, connect +1 more InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin CVE-2024-6397 9.8 CriticalJuly 11, 2024
• instawp connect – 1-click wp staging & migration, connect +1 more InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation CVE-2024-4898 Public exploit 9.8 CriticalJune 12, 2024
• instawp connect – 1-click wp staging & migration, connect +1 more InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload CVE-2024-2667 Public exploit 9.8 CriticalMay 2, 2024
• instawp connect, connect – 1-click wp staging & migration +1 more InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver CVE-2023-3956 9.8 CriticalJuly 27, 2023