Live › vulnerability › CVE-2026-109400
Go to dashboardThe InstaWP Connect plugin for WordPress exposes its master API key to low-privileged users because a management page is gated by a role name rather than a real capability check. An authenticated subscriber can use that key to call the plugin's auto-login REST endpoint and obtain an administrator session cookie.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the InstaWP Connect plugin up to and including 0.1.4.1 that are connected to InstaWP and have a lower role such as Subscriber added to the Sync Tab Access list. The mixed configuration that keeps administrator in the list also exposes the settings page to that lower role. Sites without the plugin, not connected to InstaWP, or with the access list limited to administrators are not exposed.
No product ranges from the sources yet.
wp plugin get instawp-connect --field=version, and compare against 0.1.4.1instawp_sync_tab_roles) and look for any role other than administrator, such as subscriberinstawp_api_options option is set)0.1.4.1 once a patched release is published; the sources do not name oneEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via add_management_page() using a role name returned by InstaWP_Setting::get_allowed_role() as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with generate_section_field() rendering the master API key from the instawp_api_options option directly as the value attribute of a plain-text HTML input with no additional manage_options or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API validate_api_request(), and call POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles); notably, the settings tab suppression logic only hides the tab when administrator is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.
This page as .md · .json · in your agent: get_signal("CVE-2026-109400")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.