CVE-2026-114743: InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings

Q: Who is exposed to this issue?

Sites using InstaWP Connect versions before 0.1.4.2 are exposed only if an administrator has granted a low-privileged role access to the plugin's sync feature. That role grant is not enabled by default.

Q: What does an attacker need to exploit it?

An attacker needs to be authenticated as a user in a low-privileged role that has been granted access to the InstaWP Connect sync feature. The settings-update action checks a nonce but does not perform a capability check.

Q: What could an attacker change?

The attacker can overwrite InstaWP Connect settings, including the setting that controls which roles may access the sync feature. This could allow the attacker to change access permissions for that feature.

Q: What can be done if updating is not immediately possible?

Remove low-privileged roles' access to the InstaWP Connect sync feature. Since this access grant is not enabled by default, verify that no unnecessary roles have been granted it.

Published Oct 25, 2026

Updated

The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.

Affected Software

1 affected component

InstaWP InstaWP Connect<0.1.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade InstaWP Connect to a version that resolves this vulnerability.
Fixed in 0.1.4.2

Event History

Oct 25, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using InstaWP Connect versions before 0.1.4.2 are exposed only if an administrator has granted a low-privileged role access to the plugin's sync feature. That role grant is not enabled by default.

What does an attacker need to exploit it?

An attacker needs to be authenticated as a user in a low-privileged role that has been granted access to the InstaWP Connect sync feature. The settings-update action checks a nonce but does not perform a capability check.

What could an attacker change?

The attacker can overwrite InstaWP Connect settings, including the setting that controls which roles may access the sync feature. This could allow the attacker to change access permissions for that feature.

What can be done if updating is not immediately possible?

Remove low-privileged roles' access to the InstaWP Connect sync feature. Since this access grant is not enabled by default, verify that no unnecessary roles have been granted it.

CVE-2026-114743: InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could an attacker change?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could an attacker change?

What can be done if updating is not immediately possible?