Is CVE-2026-13457 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13457 being exploited in the wild.

How severe is CVE-2026-13457?

High severity, with a CVSS score of 7.5, published 11 August 2026.

Which products and versions are affected?

InstaWP Connect up to and including 0.1.3.6.

Is there a fix for CVE-2026-13457?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13457 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13457?

Check whether you run InstaWP Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13457: InstaWP Connect remote code execution via exposed encryption key

CVE-2026-13457 · Severity: high · CVSS 7.5 · Published 2026-08-11

The InstaWP Connect WordPress plugin stores sensitive database credentials and API signatures in an encrypted configuration file that can be exposed if the web server has directory listing enabled. An attacker who discovers this file during a site migration can decrypt it and gain unauthorized database access, potentially allowing them to modify database contents, steal customer data, or take control of the WordPress site.

Technologies: InstaWP Connect. Vendors: InstaWP.

Quick answers

Is CVE-2026-13457 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13457 being exploited in the wild.
How severe is CVE-2026-13457?: High severity, with a CVSS score of 7.5, published 11 August 2026.
Which products and versions are affected?: InstaWP Connect up to and including 0.1.3.6.
Is there a fix for CVE-2026-13457?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13457 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13457?: Check whether you run InstaWP Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin stores encrypted options in a file named options-{migrate_key}.txt within the wp-content/instawpbackups/ directory without preventing directory listing via index.php or .htaccess. On Apache servers with Options +Indexes enabled, the 40-character migrate_key is directly visible to unauthenticated attackers. The encryption key is derived as SHA256(migrate_key) using AES-256-CBC, allowing an attacker to decrypt the options file and recover the database credentials and api_signature without authentication. This vulnerability is time-limited to the active migration period and requires Apache with directory indexing enabled on the backup directory. A fix is available in versions after 0.1.3.6.

Affected products

InstaWP InstaWP Connect up to and including 0.1.3.6

Timeline

2026-08-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.