InstaWP Connect – 1-click WP Staging & Migration

InstaWP Connect – 1-click WP Staging & Migration has 18 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 18 are fixed as of September 2026. Their average CVSS score is 7.6, and the most serious one scores 10.0 out of 10. Severity breakdown: 6 critical and 6 high. 2024 was the busiest year with 10 disclosures.

The most common weakness is Missing Authorization, behind 10 of the records (56%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type, Authentication Bypass Using An Alternate Path Or Channel.

Every one of the 18 issues recorded for InstaWP Connect – 1-click WP Staging & Migration has a vendor fix available, so running the current release closes all known holes.

12 independent researchers contributed these findings, most of them (4) reported by Majed Refaea. InstaWP Connect – 1-click WP Staging & Migration is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

01234567891004.11.2022Today26.07.20239.8InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver CVSS 9.8 · 26.07.202312.01.20244.3InstaWP Connect <= 0.1.0.8 - Cross-Site Request Forgery via create_file_db_manager CVSS 4.3 · 12.01.202417.01.20248.8InstaWP Connect <= 0.1.0.8 - Missing Authorization to Arbitrary Options Update CVSS 8.8 · 17.01.202424.01.20244.3InstaWP Connect <= 0.1.0.9 - Missing Authorization to Sensitive Information Dislcosure CVSS 4.3 · 24.01.20248.8InstaWP Connect <= 0.1.0.9 - Authenticated (Subscriber+) SQL Injection CVSS 8.8 · 24.01.202414.02.20248.8InstaWP Connect <= 0.1.0.8 - Authenticated (Subscriber+) Remote Code Execution CVSS 8.8 · 14.02.202412.04.20249.8InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload CVSS 9.8 · 12.04.202422.04.20244.3InstaWP Connect <= 0.1.0.24 - Missing Authorization CVSS 4.3 · 22.04.202411.06.20249.8InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation CVSS 9.8 · 11.06.202421.06.202410.0InstaWP Connect <= 0.1.0.38 - Unauthenticated Arbitrary File Upload CVSS 10.0 · 21.06.202410.07.20249.8InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin CVSS 9.8 · 10.07.202413.03.20258.8InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion CVSS 8.8 · 13.03.202529.03.20259.8InstaWP Connect <= 0.1.0.82 - Unauthenticated Local File Inclusion CVSS 9.8 · 29.03.202510.04.20258.1InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion CVSS 8.1 · 10.04.202512.12.20255.3InstaWP Connect <= 0.1.1.9 - Missing Authorization CVSS 5.3 · 12.12.202511.03.20264.3InstaWP Connect <= 0.1.2.5 - Missing Authorization CVSS 4.3 · 11.03.202611.08.20267.5InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure CVSS 7.5 · 11.08.202613.08.20265.3InstaWP Connect – 1-click WP Staging & Migration <= 0.1.3.7 - Missing Authorization CVSS 5.3 · 13.08.2026

Strategic Overview

Avg CVSSHigh
7.6/ 10
Patch Coverage100%
Open

0

Fixed

18

Get automatic notifications for all InstaWP Connect – 1-click WP Staging & Migration vulnerabilities before they are exploited.

Highest severity on recordCVSS 10.0CVE-2024-37228

InstaWP Connect <= 0.1.0.38 - Unauthenticated Arbitrary File Upload

Read the full analysis

Vulnerability Records

18 records
2026-08-13 00:00CVE-2026-73401
5.3
Medium
rajukani100Yes
2026-08-11 06:27CVE-2026-13457
7.5
High
0xsabreYes
2026-03-11 00:00CVE-2026-39504
4.3
Medium
Nabil IrawanYes
2025-12-12 00:00CVE-2025-66068
5.3
Medium
Legion HunterYes
2025-04-10 00:00CVE-2025-2636
8.1
High
ChuckYes
2025-03-29 00:00CVE-2025-31387
9.8
Critical
Dimas MaulanaYes
2025-03-13 00:00CVE-2024-13913
8.8
High
Bassem EssamYes
2024-07-10 00:00CVE-2024-6397
9.8
Critical
Truoc PhanYes
2024-06-21 00:00CVE-2024-37228
10.0
Critical
AtaTurk1925Yes
2024-06-11 21:44CVE-2024-4898
9.8
Critical
Truoc PhanYes
Showing 1–10 of 18 reports
InstaWP Connect – 1-click WP Staging & Migration banner
Latestv0.1.3.8

InstaWP Connect – 1-click WP Staging & Migration

InstaWP

Author

InstaWP

4.5(11)
90/100
Last Updated
2026-09-07 (6d ago)
Active Installs
40,000+
Downloads
2,825,888
Requires WP
5.6+
Requires PHP
7.0+
Tested up to
WP 7.0.4
Created
2022-11-04 (4y ago)

InstaWP Connect is a WordPress staging and migration plugin developed by the InstaWP team. It works as a companion tool for InstaWP – a famous tool for creating WordPress websites to test plugin or theme, product demo creation, client project delivery, and everything that can improve your WordPress workflows. The aim of this plugin is to speed up your WordPress staging process and complete it in seconds without you putting in any effort. Once you activate InstaWP Connect, you can click Create Site and connect your site to your InstaWP account. Once it’s connected, you can select to: Create quick staging [media folder will not be copied over]. Create custom staging [skip plugins, themes, media, or any specific files or folders] Create full staging [everything from your live site will be added to the staging site] One-click, and the staging creation process will begin! Once the process is complete (it takes a few minutes depending on the site’s size), you will be able to find the staging of your live site in the InstaWP dashboard. Now, it’s possible to test, develop, edit, clone, migrate, or log in to your staging site in seconds. PLUGIN FEATURES Using this companion plugin, you can connect your existing WordPress sites anywhere on the internet to your InstaWP. After your site is connected, you can create 1-click staging websites from within the WP admin panel. Create full, custom, or quick staging websites in your InstaWP dashboard Auto-login to your Connected sites from InstaWP (https://app.instawp.io/connects) 2-way sync (push from staging to production and production to staging) Check the status of actions performed during 2-way sync Connect and disconnect your WordPress live site Keep all info about your site’s health. Do everything related to Remote Management securely (File Manager, Database Manager, Plugin / Themes Installer) – Beta Utilize dozens of InstaWP features by connecting your site to it. BENEFITS OF USING INSTAWP CONNECT Staging in seconds Zero mess in your hosting account Comes with a FREE Staging Environment Simplified migration and WordPress website backup Connect multiple staging sites to your live site. WHAT IS INSTAWP? InstaWP is an online WordPress development environment to get you started with a new WP site within seconds. It allows you to create WordPress websites for testing, development, and staging in seconds. You can get a free account here – https://app.instawp.io/onboard. Key features include: Instant site creation Code Editor, DB Editor, and Logs viewer. Magic login to the WP admin panel. Migrate to any hosting provider that hosts your server (e.g., RunCloud, CloudWays, ServerAvatar, Pressable, SpinupWP, and WP Bolt) Access SFTP/SSH (pro). Drag-and-drop plugin installation Bulk theme/plugin installation from WP Repo using slugs Map a custom domain (pro) and host your site with InstaWP. Save your site as a template (snapshot of the site that can be reused). Shared templates for a public sandbox. Invite team members (pro). Git integration and GitHub actions support. Preset configurations. 3rd party services integrations (e.g., Mailchimp, active Campaign, Atarim, etc.) Core Faker Useful Resources Visit Website Read the InstaWP Documentation Know more about our API Read on How To Setup WordPress Staging Site Need support or want to partner with us? Go to our website and use the live chat feature. You can also email us at support@instawp.com. We will be happy to assist.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C