{"id":"CVE-2026-109400","kind":"vulnerability","aliases":["CVE-2026-109400"],"related":[],"title":"InstaWP Connect WordPress plugin: subscribers can escalate to administrator","description":"The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.","summary":"The InstaWP Connect plugin for WordPress exposes its master API key to low-privileged users because a management page is gated by a role name rather than a real capability check. An authenticated subscriber can use that key to call the plugin's auto-login REST endpoint and obtain an administrator session cookie.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["default-config","not-connected-to-instawp","plugin-not-installed"],"how_to_check":"- Check the installed plugin version, e.g. `wp plugin get instawp-connect --field=version`, and compare against `0.1.4.1`\n- In the WordPress admin, open the plugin's Sync Tab Access setting (`instawp_sync_tab_roles`) and look for any role other than administrator, such as subscriber\n- Confirm whether the site is connected to InstaWP (the `instawp_api_options` option is set)","fix":"- Update the InstaWP Connect plugin to a version newer than `0.1.4.1` once a patched release is published; the sources do not name one\n- Until then, deactivate the plugin or remove all non-administrator roles from the Sync Tab Access list\n- Rotate the InstaWP master API key and check for unexpected administrator accounts or sessions","status":"open","published_at":"2026-10-16T05:17:29+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:25:15+00:00","updated_at":"2026-10-25T03:25:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:25:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update the InstaWP Connect plugin to a version newer than `0.1.4.1` once a patched release is published; the sources do not name one\n- Until then, deactivate the plugin or remove all non-administrator roles from the Sync Tab Access list\n- Rotate the InstaWP master API key and check for unexpected administrator accounts or sessions","reach":"internet","title":"InstaWP Connect WordPress plugin: subscribers can escalate to administrator","impact":"high","summary":"The InstaWP Connect plugin for WordPress exposes its master API key to low-privileged users because a management page is gated by a role name rather than a real capability check. An authenticated subscriber can use that key to call the plugin's auto-login REST endpoint and obtain an administrator session cookie.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Subscriber gains administrator session and full control of the WordPress site","analyst_note":"Find the patched plugin version and fix status on the WordPress.org plugin page or the NVD entry; the sources give no fixed version.","how_to_check":"- Check the installed plugin version, e.g. `wp plugin get instawp-connect --field=version`, and compare against `0.1.4.1`\n- In the WordPress admin, open the plugin's Sync Tab Access setting (`instawp_sync_tab_roles`) and look for any role other than administrator, such as subscriber\n- Confirm whether the site is connected to InstaWP (the `instawp_api_options` option is set)","needs_analyst":true,"not_affected_if":["plugin-not-installed","not-connected-to-instawp","default-config"],"who_is_affected":"Sites running the InstaWP Connect plugin up to and including `0.1.4.1` that are connected to InstaWP and have a lower role such as Subscriber added to the Sync Tab Access list. The mixed configuration that keeps administrator in the list also exposes the settings page to that lower role. Sites without the plugin, not connected to InstaWP, or with the access list limited to administrators are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000761,"input_tokens":3728,"output_tokens":776,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109400':12A,15A '-2026':11A,14A '-256':207C '/wp-json/instawp-connect/v2/auto-login':227C '0.1.4.1':102C '1':82C '30':231C 'absent':293C 'accept':214C 'access':194C,274C 'activ':254C 'add':114C,263C 'addit':176C 'admin':111C 'administr':9A,76B,241C,260C,291C,303C 'allow':126C 'alongsid':304C 'api':33B,154C,159C,202C,220C,222C,316C 'attack':189C,265C 'attribut':166C 'authent':57B,188C,242C 'auto':69B 'auto-login':68B 'bearer':212C 'call':64B,225C 'capabl':54B,131C,138C,181C 'check':55B,182C 'click':83C 'combin':146C 'configur':301C 'connect':2A,26B,81C,255C 'cooki':78B,243C 'cve':10A,13A 'deriv':208C 'direct':162C 'due':105C 'endpoint':72B 'entir':297C 'equival':180C 'escal':7A,94C,245C 'exploit':248C 'expos':30B 'field':150C 'full':311C 'fulli':244C 'gate':45B 'generat':148C 'get':125C 'hide':287C 'hold':143C 'host':19B 'html':172C 'includ':101C,314C 'input':173C 'instawp':1A,25B,80C,123C,158C,257C,276C 'key':34B,62B,155C,203C,317C 'level':193C 'list':275C,296C 'logic':285C 'login':70B,236C 'low':37B 'low-privileg':36B 'lower':306C,321C 'lower-privileg':320C 'make':184C 'manag':42B,115C,177C 'master':32B,153C,201C 'match':139C 'mean':298C 'migrat':86C 'mint':229C 'mix':300C 'name':49B,120C 'notabl':280C 'obtain':74B 'option':160C,161C,178C 'packag':16B 'page':43B,112C,116C,313C 'plain':170C 'plain-text':169C 'plaintext':200C 'plugin':4A,23B,27B,66B,87C,108C,217C,270C 'possibl':186C 'post':226C 'privileg':38B,93C,247C,322C 'rather':50B 'read':198C 'real':53B,137C 'regist':109C 'render':151C 'request':223C 'requir':130C,249C 'resolv':134C 'rest':71B,219C 'retain':302C 'return':121C 'role':48B,119C,127C,145C,267C,279C,307C 'second':232C 'secret':209C 'section':149C 'self':18B 'self-host':17B 'serv':309C 'session':77B 'set':124C,239C,282C,312C 'sha':206C 'singl':234C 'single-us':233C 'site':251C 'stage':85C 'still':308C 'subscrib':5A,58B,192C 'subscriber-level':191C 'suppress':284C 'sync':272C,277C 'tab':273C,278C,283C,289C 'text':171C 'token':213C 'url':237C 'use':60B,117C,204C,235C 'user':39B,142C,323C 'valid':221C 'valu':165C 'version':97C 'via':113C 'vulner':91C 'wordpress':3A,20B,22B,29B,89C,133C 'wordpress-plugin':21B 'wp':84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the InstaWP Connect plugin up to and including `0.1.4.1` that are connected to InstaWP and have a lower role such as Subscriber added to the Sync Tab Access list. The mixed configuration that keeps administrator in the list also exposes the settings page to that lower role. Sites without the plugin, not connected to InstaWP, or with the access list limited to administrators are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109400","severity":null,"published_at":"2026-10-16T05:17:29+00:00","modified_at":"2026-10-16T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}