Missing authorization in InstaWP Connect lets users change settings
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.
Summary
The InstaWP Connect WordPress plugin before 0.1.4.2 lacks a capability check on its settings update action, verifying only a nonce. This missing authorization (CWE-862) lets an authenticated user with a low-privileged role granted sync access by an administrator overwrite plugin settings, including which roles may use that feature. The role grant is not enabled by default, and the references include a link to an exploit.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | InstaWP Connect | before 0.1.4.2 | 0.1.4.2 | Patch available | CNA |
- InstaWP Connect VendorUnknown Affected before 0.1.4.2 Fixed in 0.1.4.2 Patch available CNA
Remediation
Upgrade InstaWP Connect to 0.1.4.2, the fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA InstaWP Connect (Unknown) Fixed in 0.1.4.2
Timeline
- 2026-10-25 Threatist record created from CVE-2026-114743
- 2026-10-26 CVSS score added · CISA ADP
- 2026-10-26 Weakness changed · CISA ADP
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-27 Alias added: GHSA-587v-fw9w-xc4m
References
Sources
- CVE-2026-114743 · CVE Program
- CVE-2026-114743 · NVD
- FIRST EPSS
- GHSA-587v-fw9w-xc4m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences