---
id: "CVE-2026-114743"
kind: "vulnerability"
aliases: ["CVE-2026-114743"]
title: "InstaWP Connect WordPress plugin: missing capability check lets low roles change settings"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["instawp-connect", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["default-config", "plugin-version-0.1.4.2-or-later"]
published_at: "2026-10-25T06:16:32+00:00"
first_seen_at: "2026-10-25T06:36:35+00:00"
updated_at: "2026-10-25T06:37:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114743", "first_seen_at": "2026-10-25T06:36:35+00:00"}]
---

# InstaWP Connect WordPress plugin: missing capability check lets low roles change settings

The InstaWP Connect WordPress plugin before 0.1.4.2 skips a capability check on its settings-update action and only verifies a nonce. An authenticated user with a low-privileged role that an administrator granted sync access can overwrite plugin settings, including the setting that controls which roles may use that feature.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed InstaWP Connect plugin version in the WordPress admin plugins list or with `wp plugin get instawp-connect --field=version`
- Check whether any non-administrator role has been granted access to the plugin's sync feature in its settings

## Fix

- Update the InstaWP Connect plugin to `0.1.4.2` or later
- Remove sync-feature access from low-privileged roles until the update is applied

## Timeline

- 2026-10-25T06:36:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114743

## From the sources

The InstaWP Connect  WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect  WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect  WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect  WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_