CVE-2025-2636 is a path traversal vulnerability (CWE-22) in the InstaWP Connect – 1-click WP Staging & Migration WordPress plugin versions up to 0.1.0.85. It arises from improper limitation of pathname input via the 'instawp-database-manager' parameter, enabling local file inclusion. An unauthenticated attacker can include and execute arbitrary files on the server, including PHP code, if such files exist or can be uploaded through other vulnerabilities. This vulnerability can lead to bypassing access controls, data disclosure, or code execution. However, since the plugin itself does not allow arbitrary file uploads, remote code execution is not achievable solely through this flaw. No known exploits are reported in the wild, and no patch is currently available.

Successful exploitation can lead to local file inclusion allowing execution of arbitrary PHP code if attacker-controlled files are present on the server. This can result in bypassing access controls, disclosure of sensitive information, and potential code execution. However, without an additional file upload vulnerability, remote code execution is unlikely. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Mitigation may require restricting access to the vulnerable parameter or disabling the plugin until a fix is released. No generic mitigations are recommended beyond this due to the specific nature of the vulnerability.