Log in Start free

InstaWP

Products

ProductCVEsExploitedLatest
InstaWP Connect11–Oct 29, 2026
InstaWP Connect – 1-click WP Staging & Migration8–Oct 16, 2026
String locator3–Jan 21, 2025

Exploited and recent CVEs

  • CVE-2026-116399 High 8.8 WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2026-109400 High 7.5 InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting 0.3%
  • CVE-2026-73401 Medium 5.3 WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability 0.3%
  • CVE-2026-13457 High 7.5 InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure 0.9%
  • CVE-2026-39504 Medium 5.4 WordPress InstaWP Connect plugin <= 0.1.2.5 - Broken Access Control vulnerability 0.2%
  • CVE-2025-66068 Medium 6.5 WordPress InstaWP Connect plugin <= 0.1.1.9 - Broken Access Control vulnerability 0.2%
  • CVE-2025-2636 High 8.1 InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion 10.6%
  • CVE-2025-31387 High 7.5 WordPress InstaWP Connect plugin <= 0.1.0.82 - Local File Inclusion vulnerability 0.5%
  • CVE-2024-13913 High 8.8 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion 2.7%
  • CVE-2024-10936 High 8.8 String Locator <= 2.6.6 - Unauthenticated PHP Object Injection 1.1%
  • CVE-2023-6987 Medium 6.1 String Locator <= 2.6.5 - Reflected Cross-Site Scripting 0.3%
  • CVE-2024-6397 Critical 9.8 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin 0.7%
  • CVE-2024-37228 Critical 10.0 WordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerability 0.5%
  • CVE-2024-4898 Critical 9.8 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation 4.2%
  • CVE-2024-32701 Medium 4.3 WordPress InstaWP Connect plugin <= 0.1.0.24 - Broken Access Control vulnerability 0.3%
  • CVE-2024-22145 High 8.8 WordPress InstaWP Connect plugin <= 0.1.0.8 - Arbitrary Option Update to Privilege Escalation vulnerability 1.1%
  • CVE-2024-2667 Critical 9.8 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload 5.7%
  • CVE-2024-25918 Critical 9.9 WordPress InstaWP Connect plugin <= 0.1.0.8 - Remote Code Execution vulnerability 0.7%
  • CVE-2024-23507 High 8.5 WordPress InstaWP Connect plugin <= 0.1.0.9 - SQL Injection vulnerability 0.6%
  • CVE-2024-23506 High 7.7 WordPress InstaWP Connect plugin <= 0.1.0.9 - Sensitive Data Exposure vulnerability 0.5%
  • CVE-2023-3956 Critical 9.8 InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver 1.0%
  • CVE-2022-2434 High 8.8 String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization 1.6%