What’s Vulnerable › Products
InstaWP Connect vulnerabilities
19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.
Check whether your InstaWP Connect version is affected
Latest InstaWP Connect vulnerabilities
- CVE-2026-116399 — WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- CVE-2026-109400 — InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting (CVSS 7.5)
- CVE-2026-73401 — WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-13457 — InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure (CVSS 7.5)
- CVE-2026-39504 — WordPress InstaWP Connect plugin <= 0.1.2.5 - Broken Access Control vulnerability (CVSS 5.4)
- CVE-2025-66068 — WordPress InstaWP Connect plugin <= 0.1.1.9 - Broken Access Control vulnerability (CVSS 6.5)
- CVE-2025-2636 — InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion (CVSS 8.1)
- CVE-2025-31387 — WordPress InstaWP Connect plugin <= 0.1.0.82 - Local File Inclusion vulnerability (CVSS 7.5)
- CVE-2024-13913 — InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion (CVSS 8.8)
- CVE-2024-6397 — InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin (CVSS 9.8)
- CVE-2024-37228 — WordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerability (CVSS 9.8)
- CVE-2024-4898 — InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation (CVSS 9.8)
- CVE-2024-32701 — WordPress InstaWP Connect plugin <= 0.1.0.24 - Broken Access Control vulnerability (CVSS 8.8)
- CVE-2024-22145 — WordPress InstaWP Connect plugin <= 0.1.0.8 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 8.8)
- CVE-2024-2667 — InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
- CVE-2024-25918 — WordPress InstaWP Connect plugin <= 0.1.0.8 - Remote Code Execution vulnerability (CVSS 8.8)
- CVE-2024-23507 — WordPress InstaWP Connect plugin <= 0.1.0.9 - SQL Injection vulnerability (CVSS 8.8)
- CVE-2024-23506 — WordPress InstaWP Connect plugin <= 0.1.0.9 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- CVE-2023-3956 — InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver (CVSS 9.8)