InstaWP migration artifacts expose database credentials and API signature
InstaWP Connect through 0.1.3.6 can expose migration artifacts when a migration is active and Apache directory indexing is enabled for wp-content/instawpbackups/. Listing that directory reveals options-{migrate_key}.txt and its 40-character migration key. An unauthenticated attacker can derive the AES-256-CBC passphrase as SHA256(migrate_key), decrypt the file, and recover database credentials and api_signature. The CNA labels the issue remote code execution, but the disclosed path establishes credential and signature exposure only; the subsequent request or function that executes code is not disclosed.
- Component
- InstaWP Connect – 1-click WP Staging & Migration
- Plugin slug
instawp-connect- Affected
- <= 0.1.3.6
- Safe version
0.1.3.7- Published
- Aug 11, 2026
This CVE was published Aug 11, 2026 and is one of 19 known issues for this plugin.
Update, patch or deactivate.
Update to 0.1.3.7 or later immediately. Remove exposed migration artifacts, disable directory listing, rotate database credentials and API signatures, and review migration and administrative activity for misuse.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N