IC
Product
InstaWP Connect – 1-click WP Staging & Migration
8
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 4High 4Medium 0Low 0
Watch
Add InstaWP Connect – 1-click WP Staging & Migration to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-6397 | 9.8 | Jul 11 | InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin Affected: through 0.1.0.44 |
| CVE-2024-4898 | 9.8 | Jun 12 | InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation Affected: through 0.1.0.38 |
| CVE-2024-2667 | 9.8 | May 2 | InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload Affected: through 0.1.0.22 |
| CVE-2023-3956 | 9.8 | Jul 27 | InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver Affected: through 0.0.9.18 |
| CVE-2024-13913 | 8.8 | Mar 14 | InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion Affected: through 0.1.0.83 |
| CVE-2025-2636 | 8.1 | Apr 11 | InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion Affected: through 0.1.0.85 |
| CVE-2026-109400 | 7.5 | Oct 16 | InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting Affected: through 0.1.4.1 |
| CVE-2026-13457 | 7.5 | Aug 11 | InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure Affected: through 0.1.3.6 |
Showing 8