connect_1-click_wp_staging_migration vulnerabilities

CVEs whose affected-version data names the connect_1-click_wp_staging_migration package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-109400High· 7.5

today

InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()…

▾ Twilightinstawp · InstaWP Connect – 1-click WP Staging & Migrationvia CVEORG