Description
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file types can be uploaded and included, or are already present on the filesystem locally. There are currently no known vulnerabilities in this plugin that make file upload possible, meaning this won't be exploitable to achieve remote code execution on most instances with just this plugin alone. Another vulnerability would need to be present on the site allowing arbitrary file upload in order to leverage this to achieve remote code execution.
Published: 2025-04-11
Score: 8.1 High
EPSS: 6.8% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the InstaWP Connect plugin for WordPress, where the 'instawp-database-manager' parameter allows a local file inclusion. An unauthenticated attacker can specify any file path that is readable by the server, and the plugin will include and execute that file as PHP. This can lead to execution of arbitrary PHP code, allowing attackers to bypass access controls, read sensitive data, or perform further compromise. The weakness is a classic Local File Inclusion (CWE-22).

Affected Systems

All versions of InstaWP Connect - 1-click WP Staging & Migration up to and including 0.1.0.85 are affected. The vendor product is an installer for WordPress that is commonly added by site owners to ease staging and migration tasks.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity. An EPSS score of 7% implies a moderate likelihood that the vulnerability will be exploited in the wild. Because the flaw is unauthenticated but requires a local file path, it is not a straightforward remote code execution unless an additional vulnerability that permits file upload or direct file discovery exists. The vulnerability is not listed in the CISA KEV catalog. Attackers are presumed to target exposed file paths or misconfigured directories. The lack of a known file-upload flaw in the plugin alone limits immediate RCE risk, but the presence of other plugins or misconfigured file permissions could allow exploitation.

Generated by OpenCVE AI on May 23, 2026 at 14:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the InstaWP Connect plugin to a version newer than 0.1.0.85 or remove it if it is not needed.
  • If an upgrade is not possible, disable or remove the 'instawp-database-manager' functionality so that the vulnerable parameter cannot be called.
  • Check the site for other plugins or configurations that allow arbitrary file upload or local file discovery, and remediate those as well.

Generated by OpenCVE AI on May 23, 2026 at 14:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Apr 2026 17:45:00 +0000

Type Values Removed Values Added
Description The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file types can be uploaded and included, or are already present on the filesystem locally. There are currently no known vulnerabilities in this plugin that make file upload possible, meaning this won't be exploitable to achieve remote code execution on most instances with just this plugin alone. Another vulnerability would need to be present on the site allowing arbitrary file upload in order to leverage this to achieve remote code execution.
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Fri, 11 Apr 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 11 Apr 2025 04:30:00 +0000

Type Values Removed Values Added
Description The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Title InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:51:18.594Z

Reserved: 2025-03-21T22:12:30.783Z

Link: CVE-2025-2636

cve-icon Vulnrichment

Updated: 2025-04-11T15:09:56.350Z

cve-icon NVD

Status : Deferred

Published: 2025-04-11T05:15:31.013

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-2636

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-23T14:45:19Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')