Executive brief
The InstaWP Connect WordPress plugin stores sensitive database credentials and API signatures in an encrypted configuration file that can be exposed if the web server has directory listing enabled. An attacker who discovers this file during a site migration can decrypt it and gain unauthorized database access, potentially allowing them to modify database contents, steal customer data, or take control of the WordPress site.
Technical details
The plugin stores encrypted options in a file named options-{migrate_key}.txt within the wp-content/instawpbackups/ directory without preventing directory listing via index.php or .htaccess. On Apache servers with Options +Indexes enabled, the 40-character migrate_key is directly visible to unauthenticated attackers. The encryption key is derived as SHA256(migrate_key) using AES-256-CBC, allowing an attacker to decrypt the options file and recover the database credentials and api_signature without authentication. This vulnerability is time-limited to the active migration period and requires Apache with directory indexing enabled on the backup directory. A fix is available in versions after 0.1.3.6.
Affected products
- InstaWP InstaWP Connect up to and including 0.1.3.6
Timeline
- 2026-08-11: disclosed