Live › vulnerability › CVE-2026-116399
InstaWP Connect (instawp-connect) is vulnerable to cross-site request forgery, affecting versions through 0.1.4.2. An attacker who lures a logged-in site administrator to a malicious page can make the plugin perform actions on the site as that administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Sites running the InstaWP Connect plugin at version 0.1.4.2 or earlier are in the affected range. The exposure depends on an administrator being tricked into visiting an attacker-controlled page while logged in; sites without the plugin installed can skip it.
No product ranges from the sources yet.
wp plugin get instawp-connect --field=version0.1.4.20.1.4.2 is not stated in the sources; unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-116399")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.