CVE-2026-13457: InstaWP Connect WordPress Plugin RCE Flaw

CVE-2026-13457 Overview

CVE-2026-13457 affects the InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress in all versions up to and including 0.1.3.6. The plugin stores its encrypted options file at wp-content/instawpbackups/options-{migrate_key}.txt without deploying an index.php or .htaccess file. On Apache servers with directory indexing enabled, unauthenticated attackers can enumerate the 40-character migrate_key, derive the AES-256-CBC passphrase via SHA256(migrate_key), and decrypt the options file to recover database credentials and the api_signature. The weakness maps to [CWE-434] and is exploitable only during an active migration window.

Critical Impact
Unauthenticated attackers can obtain database access details and the api_signature, resulting in complete confidentiality loss of migration secrets.

Affected Products

InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress
All versions up to and including 0.1.3.6
Deployments hosted on Apache with Options +Indexes enabled for wp-content/instawpbackups/

Discovery Timeline

2026-08-11 - CVE-2026-13457 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-13457

Vulnerability Analysis

The InstaWP Connect plugin writes an encrypted options blob to disk at wp-content/instawpbackups/options-{migrate_key}.txt during migration operations. The filename embeds the 40-character migrate_key, which also acts as the seed material for the encryption passphrase. The plugin omits the standard WordPress hardening pattern of dropping an index.php or .htaccess directory-listing suppressor into its writable directories. On Apache installations that enable directory indexing, browsing to /wp-content/instawpbackups/ reveals the filename and therefore the migrate_key itself.

An unauthenticated attacker can then compute the AES-256-CBC passphrase as SHA256(migrate_key), retrieve the options-{migrate_key}.txt payload, and decrypt it. The plaintext exposes database credentials and the api_signature used by the plugin's remote API. Exploitation is time-bounded because the file only exists during an active migration.

Root Cause

The root cause is a missing security constraint on a writable plugin directory combined with a key-in-filename design pattern. Storing the secret material inside the filename means that any directory-listing exposure is equivalent to full key disclosure. The plugin does not enforce filesystem-level access controls or randomize the storage path outside of the guessable key.

Attack Vector

Exploitation requires network access to the WordPress site, Apache as the web server, and directory indexing enabled for the wp-content/instawpbackups/ path. No authentication or user interaction is required. The attacker issues an HTTP GET request against the directory, parses the returned HTML index to extract the migrate_key from the filename, derives the passphrase, downloads the encrypted file, and decrypts it offline. Technical details are documented in the Wordfence Vulnerability Report and the WordPress Plugin Code Snippet.

Detection Methods for CVE-2026-13457

Indicators of Compromise

HTTP GET requests to /wp-content/instawpbackups/ returning 200 OK with Content-Type: text/html and an Apache directory index body.
Requests to options-*.txt files under wp-content/instawpbackups/ from external IP addresses.
Access log entries referencing 40-character hexadecimal or alphanumeric filenames in the instawpbackups path.

Detection Strategies

Audit Apache configuration for Options +Indexes on any directory beneath wp-content/.
Scan the WordPress filesystem for the presence of wp-content/instawpbackups/options-*.txt and validate whether an index.php or .htaccess deny rule exists.
Correlate web server access logs for anonymous requests enumerating plugin backup directories.

Monitoring Recommendations

Alert on unauthenticated external access to wp-content/instawpbackups/ in web server logs and WAF telemetry.
Monitor for unexpected changes to the WordPress database user or unauthorized use of the InstaWP api_signature.
Track newly created files matching options-*.txt in plugin-writable directories using file integrity monitoring.

How to Mitigate CVE-2026-13457

Immediate Actions Required

Update InstaWP Connect to a version newer than 0.1.3.6 that includes the fix from changeset 3634049.
Disable directory indexing on Apache globally or for wp-content/ and all subdirectories.
Rotate any database credentials and InstaWP api_signature values that may have been exposed during past migrations.
Delete residual options-*.txt files under wp-content/instawpbackups/ after migrations complete.

Patch Information

The vendor addressed the issue in the plugin update tracked by WordPress Plugin Changeset 3634049. Administrators should upgrade InstaWP Connect through the WordPress plugin manager and verify the installed version is greater than 0.1.3.6.

Workarounds

Deploy an .htaccess file inside wp-content/instawpbackups/ containing Options -Indexes to suppress directory listings.
Place an empty index.php file in wp-content/instawpbackups/ to prevent directory enumeration on default Apache configurations.
Deny external access to wp-content/instawpbackups/ at the web server or WAF layer until patching is complete.

bash

# Configuration example: disable directory indexing for the plugin path
cat > /var/www/html/wp-content/instawpbackups/.htaccess <<'EOF'
Options -Indexes
<FilesMatch "^options-.*\.txt$">
    Require all denied
</FilesMatch>
EOF

# Global Apache hardening (httpd.conf or site vhost)
# <Directory /var/www/html/wp-content>
#     Options -Indexes
# </Directory>