CVE-2025-2636

Deeper analysis

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to local file inclusion in all versions through 0.1.0.85. The flaw exists in the handling of the instawp-database-manager parameter, which can be abused to include and execute arbitrary local files, enabling an attacker to run PHP code present on the server. The issue is tracked as CWE-22 and carries a CVSS 3.1 score of 8.1.

Unauthenticated attackers reachable over the network can exploit the parameter to bypass access controls, read sensitive data, or obtain code execution when a separate vulnerability permits arbitrary file uploads or when suitable PHP files already exist on the filesystem. The attack requires high complexity because the plugin itself does not provide a file-upload primitive, so remote code execution is not achievable with this issue alone on most sites.

Public references point to a patched version released via the WordPress plugin repository changeset 3269681, which addresses the loader.php file at the cited line; administrators are advised to update the plugin promptly. Wordfence threat intelligence further documents the vulnerability and confirms the availability of the fix.

EPSS for the CVE rose from a low baseline to a peak of 0.1354 on 2025-12-11 before receding to the current value of 0.0680, indicating a measurable increase in exploitation interest after disclosure. No confirmed in-the-wild exploitation has been reported.