{"id":"CVE-2026-114743","kind":"vulnerability","aliases":["CVE-2026-114743"],"related":[],"title":"InstaWP Connect WordPress plugin: missing capability check lets low roles change settings","description":"The InstaWP Connect  WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect  WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect  WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect  WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.","summary":"The InstaWP Connect WordPress plugin before 0.1.4.2 skips a capability check on its settings-update action and only verifies a nonce. An authenticated user with a low-privileged role that an administrator granted sync access can overwrite plugin settings, including the setting that controls which roles may use that feature.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["instawp-connect","package","wordpress","wordpress-plugin"],"not_affected_if":["default-config","plugin-version-0.1.4.2-or-later"],"how_to_check":"- Check the installed InstaWP Connect plugin version in the WordPress admin plugins list or with `wp plugin get instawp-connect --field=version`\n- Check whether any non-administrator role has been granted access to the plugin's sync feature in its settings","fix":"- Update the InstaWP Connect plugin to `0.1.4.2` or later\n- Remove sync-feature access from low-privileged roles until the update is applied","status":"open","published_at":"2026-10-25T06:16:32+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:36+00:00","updated_at":"2026-10-25T06:37:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T06:37:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update the InstaWP Connect plugin to `0.1.4.2` or later\n- Remove sync-feature access from low-privileged roles until the update is applied","reach":"internet","title":"InstaWP Connect WordPress plugin: missing capability check lets low roles change settings","impact":"medium","summary":"The InstaWP Connect WordPress plugin before 0.1.4.2 skips a capability check on its settings-update action and only verifies a nonce. An authenticated user with a low-privileged role that an administrator granted sync access can overwrite plugin settings, including the setting that controls which roles may use that feature.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","instawp-connect"],"confidence":0.8,"needs_auth":"yes","worst_case":"Low-privileged user alters plugin settings and widens their own access","analyst_note":"","how_to_check":"- Check the installed InstaWP Connect plugin version in the WordPress admin plugins list or with `wp plugin get instawp-connect --field=version`\n- Check whether any non-administrator role has been granted access to the plugin's sync feature in its settings","needs_analyst":false,"not_affected_if":["default-config","plugin-version-0.1.4.2-or-later"],"who_is_affected":"Sites running the InstaWP Connect WordPress plugin before 0.1.4.2 where an administrator has granted a low-privileged role access to the sync feature. The role grant is not enabled by default, so sites that never granted that access are not exposed through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000627,"input_tokens":3416,"output_tokens":570,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114743':15A,18A '-2026':14A,17A '0.1.4.2':33B,85C,99C,130C,142C 'access':63B,122C,152C 'action':43B,102C 'administr':60B,119C 'allow':107C 'authent':50B,109C 'capabl':6A,36B,90C 'chang':11A 'check':7A,37B,91C 'connect':2A,21B,29B,81C,95C,126C,138C 'control':72B,148C 'cve':13A,16A 'default':162C 'enabl':160C 'featur':78B,133C,154C 'grant':61B,121C,157C 'hold':111C 'includ':68B,145C 'instawp':1A,20B,28B,80C,94C,125C,137C 'instawp-connect':19B 'let':8A 'low':9A,55B,114C 'low-privileg':54B,113C 'may':75B,151C 'miss':5A 'nonc':48B,106C 'overwrit':65B,135C 'packag':22B 'perform':88C 'plugin':4A,26B,31B,66B,83C,97C,128C,140C 'privileg':56B,115C 'role':10A,57B,74B,116C,150C,156C 'set':12A,41B,67B,70B,100C,144C,147C 'settings-upd':40B 'skip':34B 'sync':62B,132C 'updat':42B,101C 'use':76B 'user':51B,110C 'verifi':46B,103C 'wordpress':3A,23B,25B,30B,82C,96C,127C,139C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the InstaWP Connect WordPress plugin before 0.1.4.2 where an administrator has granted a low-privileged role access to the sync feature. The role grant is not enabled by default, so sites that never granted that access are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114743","severity":null,"published_at":"2026-10-25T06:16:32+00:00","modified_at":"2026-10-25T06:16:32+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}