CVE-2026-13457 affects the InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress in all versions up to and including 0.1.3.6. The plugin stores an encrypted options file named options-{migrate_key}.txt in the wp-content/instawpbackups/ directory without protective measures such as index.php or .htaccess files to prevent directory listing. On Apache servers with directory indexing enabled (Options +Indexes), an attacker can discover the 40-character migrate_key, derive the AES-256-CBC passphrase via SHA256(migrate_key), and decrypt the options file to obtain the api_signature and database access details. This vulnerability allows unauthenticated remote attackers to access sensitive credentials during the limited migration period. Exploitation requires the target to be hosted on Apache with directory listing enabled for the specific directory.

An unauthenticated attacker can remotely obtain sensitive credentials including the api_signature and database access details by exploiting directory listing enabled on Apache servers hosting the vulnerable plugin. This can lead to remote code execution. The impact is limited to the migration period and requires specific server configuration (directory listing enabled).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should disable directory listing (Options -Indexes) on Apache servers for the wp-content/instawpbackups/ directory or restrict access to this directory to prevent exposure of the migrate_key and encrypted options file.