CVE-2026-39504
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The InstaWP Connect plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.1.2.5.
Risk Assessment
An attacker can gain unauthorized access to administrative functions, potentially leading to full site takeover.
Recommendation
Immediately update the InstaWP Connect plugin to the latest available version.
Other vulnerabilities in InstaWP Connect
See all- CVE-2026-73401Medium
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
- CVE-2026-13457High
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6. The plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled and is time limited to the migration period.
Original NVD description (English source)
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.2.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS