---
id: "CVE-2026-109400"
kind: "vulnerability"
aliases: ["CVE-2026-109400"]
title: "InstaWP Connect WordPress plugin: subscribers can escalate to administrator"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["default-config", "not-connected-to-instawp", "plugin-not-installed"]
published_at: "2026-10-16T05:17:29+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:25:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109400", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# InstaWP Connect WordPress plugin: subscribers can escalate to administrator

The InstaWP Connect plugin for WordPress exposes its master API key to low-privileged users because a management page is gated by a role name rather than a real capability check. An authenticated subscriber can use that key to call the plugin's auto-login REST endpoint and obtain an administrator session cookie.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version, e.g. `wp plugin get instawp-connect --field=version`, and compare against `0.1.4.1`
- In the WordPress admin, open the plugin's Sync Tab Access setting (`instawp_sync_tab_roles`) and look for any role other than administrator, such as subscriber
- Confirm whether the site is connected to InstaWP (the `instawp_api_options` option is set)

## Fix

- Update the InstaWP Connect plugin to a version newer than `0.1.4.1` once a patched release is published; the sources do not name one
- Until then, deactivate the plugin or remove all non-administrator roles from the Sync Tab Access list
- Rotate the InstaWP master API key and check for unexpected administrator accounts or sessions

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109400

## From the sources

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_