The vulnerability resides in the InstaWP Connect WordPress plugin, which stores an encrypted options file containing database credentials and an API signature in the wp-content/instawpbackups/ directory. Because the plugin does not provide protection against directory listing (missing index.php or .htaccess restrictions), an attacker can download the file if the server is running Apache with Options +Indexes enabled. By accessing the file, the attacker can derive the AES‑256‑CBC passphrase from the migrate_key, decrypt the file, and obtain the database access details and api_signature, enabling them to execute arbitrary code on the WordPress site.

Any WordPress site running InstaWP Connect – 1‑click WP Staging & Migration plugin version 0.1.3.6 or earlier on an Apache web server with directory listing turned on is affected. No other WordPress plugins or versions are indicated, and the problem occurs only when the migration feature is active.

The CVSS score of 7.5 classifies the flaw as high severity, and the EPSS score of less than 1 % indicates a very low but still present likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to target an Apache server with directory indexing enabled and perform the exploit during an active migration window, but once the key is exposed they can gain database credentials and elevate privileges. Because the issue relies on a configuration setting (indexing), defenders can mitigate by disabling listing or updating the plugin.