Live › vulnerability › CVE-2026-114743
Go to dashboardThe InstaWP Connect WordPress plugin before 0.1.4.2 skips a capability check on its settings-update action and only verifies a nonce. An authenticated user with a low-privileged role that an administrator granted sync access can overwrite plugin settings, including the setting that controls which roles may use that feature.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the InstaWP Connect WordPress plugin before 0.1.4.2 where an administrator has granted a low-privileged role access to the sync feature. The role grant is not enabled by default, so sites that never granted that access are not exposed through this path.
No product ranges from the sources yet.
wp plugin get instawp-connect --field=version0.1.4.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.
This page as .md · .json · in your agent: get_signal("CVE-2026-114743")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.