CVE-2026-13457: InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migratekey}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migratekey on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migratekey), decrypt the options file to recover the apisignature. This makes it possible for unauthenticated attackers to get the database access details and apisignature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: InstaWP Connect – 1-click WP Staging & Migrationto a version that resolves this vulnerability.Fixed in 0.1.3.6 - Compensating control
Ensure directory listing is not enabled for Apache on the wp-content/instawpbackups/ directory (the issue requires Options +Indexes for that path).
- Compensating control
Restrict external access to the wp-content/instawpbackups/ directory (e.g., block at the web server/ACL) so the attacker cannot retrieve options-{migrate_key}.txt from that location.
Event History
Frequently Asked Questions
What is CVE-2026-13457?
CVE-2026-13457 is a high severity vulnerability affecting the InstaWP Connect plugin that allows unauthenticated cryptographic key disclosure.
What is the severity of CVE-2026-13457?
The severity of CVE-2026-13457 is rated as high, with a score of 7.5 according to the CVSS metrics.
How do I fix CVE-2026-13457?
To fix CVE-2026-13457, users should update the InstaWP Connect plugin to version 0.1.3.7 or later, where the vulnerability has been patched.
What are the potential risks of CVE-2026-13457?
The potential risks of CVE-2026-13457 include remote code execution due to the unauthorized access to cryptographic keys.
Is CVE-2026-13457 exploitable without authentication?
Yes, CVE-2026-13457 is exploitable without authentication, allowing attackers to access sensitive information.