CVE-2025-66068
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The InstaWP Connect plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 0.1.1.9.
Risk Assessment
An attacker could gain unauthorized access to administrative functions, potentially leading to full site compromise.
Recommendation
Update the InstaWP Connect plugin to the latest available version that includes the security fix.
Other vulnerabilities in InstaWP Connect
See all- CVE-2026-73401Medium
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
- CVE-2026-13457High
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6. The plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled and is time limited to the migration period.
- CVE-2026-39504Medium
The InstaWP Connect plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.1.2.5.
Original NVD description (English source)
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.1.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS