InstaWP vulnerabilities
22 published CVEs name InstaWP among the affected products.
- 22Published CVEs22 of them scored
- 6Last 12 monthspublished in the last year
- 6Critical11 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-116399
WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability
InstaWP · InstaWP Connect
High8.8 - CVE-2026-109400
InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
instawp · InstaWP Connect – 1-click WP Staging & Migration
High7.5 - CVE-2026-73401
WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability
InstaWP · InstaWP Connect
Medium5.3 - CVE-2026-13457
InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure
instawp · InstaWP Connect – 1-click WP Staging & Migration
High7.5 - CVE-2026-39504
WordPress InstaWP Connect plugin <= 0.1.2.5 - Broken Access Control vulnerability
InstaWP · InstaWP Connect
Medium5.4 - CVE-2025-66068
WordPress InstaWP Connect plugin <= 0.1.1.9 - Broken Access Control vulnerability
InstaWP · InstaWP Connect
Medium6.5 - CVE-2025-2636
InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion
instawp · InstaWP Connect – 1-click WP Staging & Migration
High8.1 - CVE-2025-31387
WordPress InstaWP Connect plugin <= 0.1.0.82 - Local File Inclusion vulnerability
InstaWP · InstaWP Connect
High7.5 - CVE-2024-13913
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion
instawp · InstaWP Connect – 1-click WP Staging & Migration
High8.8 - CVE-2024-10936
String Locator <= 2.6.6 - Unauthenticated PHP Object Injection
instawp · String locator
High8.8