InstaWP Connect – 1-click WP Staging & Migration <= 0.1.4.1 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Plugin/Theme Zip Copies
- ID
- WPSEC-2026-0939
- Plugin
- InstaWP Connect – 1-click WP Staging & Migration (instawp-connect)
- Affected
- from 0.1.2.3 before 0.1.4.2
- Remediation
- Update to 0.1.4.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-552
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-14
- Attack surface
- InstaWP Connect – 1-click WP Staging & Migration on WPSec AttackSurface
- Fix released
- Published
Description
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Sensitive Information Exposure via the plugin and theme zip copies kept for two-way sync in versions 0.1.2.3 to 0.1.4.1, due to the plugin saving a copy of every plugin or theme zip an administrator uploads into the publicly accessible wp-content/instawpbackups/plugins/ or instawpbackups/themes/ directory under a predictable name derived from the plugin or theme slug. The copy is made even when sync is not in use and is removed only when a sync event for it completes, so on most sites it stays indefinitely. This makes it possible for unauthenticated attackers to download these archives, which may contain premium or private plugin and theme code. On sites upgraded to 0.1.4.2, a copy that belongs to a sync event that has not yet completed stays at its old address until that event completes.
References
- https://wpsec.com/vuln/WPSEC-2026-0939/
- https://plugins.svn.wordpress.org/instawp-connect/tags/0.1.4.2/
- https://wordpress.org/plugins/instawp-connect/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS