CVE-2026-109400: CWE-269 Improper Privilege Management in instawp InstaWP Connect – 1-click WP Staging & Migration

The vulnerability in InstaWP Connect – 1-click WP Staging & Migration (<=0.1.4.1) stems from the plugin registering its admin page with a capability derived from a role name, which WordPress interprets as a capability match for any user holding that role. The master API key is rendered in plaintext in the settings page without sufficient capability checks. Authenticated users with Subscriber-level access or above can read this key if their role is added to the Sync Tab Access list alongside the administrator role. Using the API key's SHA-256-derived secret as a bearer token, attackers can call the plugin's REST API endpoint to generate a 30-second single-use login URL that sets an administrator authentication cookie, thereby escalating privileges. The issue depends on specific plugin configuration and active connection to InstaWP.

An authenticated user with Subscriber-level access or higher can obtain the plaintext master API key and use it to generate a temporary login URL that grants administrator privileges. This results in full privilege escalation, compromising the site's administrative control, confidentiality, integrity, and availability. The vulnerability affects all sites using the vulnerable plugin versions with the described configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should review and restrict roles listed in the plugin's Sync Tab Access list, ensuring that lower-privileged roles are not included alongside the administrator role. Additionally, consider disconnecting the site from InstaWP if possible to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.