CVE-2026-116399: WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

Q: What does an attacker need to exploit this issue?

An attacker must be able to persuade a user to interact with a crafted request, as indicated by the required user interaction in the CVSS vector. No attacker privileges are required.

Q: Which installations are affected?

InstaWP Connect versions through 0.1.4.2 are affected. The available information does not state whether any particular plugin configuration is required.

Published Oct 29, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress InstaWP Connect plugin to a version that resolves this vulnerability.
Fixed in 0.1.4.3

Event History

Oct 29, 2026

CVE Published

via MITRE·01:54 PM

Data Sourced

via MITRE·01:54 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker must be able to persuade a user to interact with a crafted request, as indicated by the required user interaction in the CVSS vector. No attacker privileges are required.

Which installations are affected?