CVE-2026-114743

InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings

The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.

Affected

InstaWP Connect

CVSS v3.1 CNA

3.1 LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.17% chance of exploitation in the next 30 days, 7th percentile

Published

2026-10-25

Updated

2026-10-26

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/b94671c5-c5b5-418d-ac9c-af21c7cbc6a4/find archive

CVE references

• https://wpscan.com/vulnerability/b94671c5-c5b5-418d-ac9c-af21c7cbc6a4REFERENCE

References

• CVE Record
• NVD entry