CVE-2026-73401
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
Risk Assessment
The risk is the possibility of unauthorized access to administrative functions or data, potentially leading to compromise of system integrity and confidentiality.
Recommendation
It is recommended to update the InstaWP Connect plugin to a version newer than 0.1.3.7, which includes a fix for this vulnerability.
Other vulnerabilities in InstaWP Connect
See all- CVE-2026-13457High
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6. The plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled and is time limited to the migration period.
- CVE-2026-39504Medium
The InstaWP Connect plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.1.2.5.
- CVE-2025-66068Medium
The InstaWP Connect plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 0.1.1.9.
Original NVD description (English source)
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS