{
 "id": "WPSEC-2026-0939",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0939/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0939/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0939/index.md",
 "title": "InstaWP Connect – 1-click WP Staging & Migration <= 0.1.4.1 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Plugin/Theme Zip Copies",
 "description": "The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Sensitive Information Exposure via the plugin and theme zip copies kept for two-way sync in versions 0.1.2.3 to 0.1.4.1, due to the plugin saving a copy of every plugin or theme zip an administrator uploads into the publicly accessible wp-content/instawpbackups/plugins/ or instawpbackups/themes/ directory under a predictable name derived from the plugin or theme slug. The copy is made even when sync is not in use and is removed only when a sync event for it completes, so on most sites it stays indefinitely. This makes it possible for unauthenticated attackers to download these archives, which may contain premium or private plugin and theme code. On sites upgraded to 0.1.4.2, a copy that belongs to a sync event that has not yet completed stays at its old address until that event completes.",
 "plugin": {
  "slug": "instawp-connect",
  "name": "InstaWP Connect – 1-click WP Staging & Migration",
  "full_name": "InstaWP Connect – 1-click WP Staging & Migration",
  "wordpress_org": "https://wordpress.org/plugins/instawp-connect/",
  "advisories_url": "https://wpsec.com/vuln/plugin/instawp-connect/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/instawp-connect"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-552"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "0.1.2.3",
    "from_inclusive": true,
    "to": "0.1.4.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 0.1.2.3 before 0.1.4.2"
  ]
 },
 "introduced_in": "0.1.2.3",
 "fixed_in": "0.1.4.2",
 "remediation": "Update to 0.1.4.2 or later.",
 "fix_released": "2026-10-13T11:48:52+00:00",
 "published": "2026-10-14T13:49:25+00:00",
 "updated": "2026-10-14T13:19:57.043836+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0939/",
  "https://plugins.svn.wordpress.org/instawp-connect/tags/0.1.4.2/",
  "https://wordpress.org/plugins/instawp-connect/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/instawp-connect",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-14"
 }
}