CVE-2026-114743: CWE-862 Missing Authorization in InstaWP Connect
Affects InstaWP ConnectSource CVE Database V5
Not known to be exploited.
Data as of 10/25/2026, 06:20:55 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| InstaWP Connect | Affected
| Fixed in
|
AI-suggested
Upgrade the InstaWP Connect plugin to version 0.1.4.2 or later once available. Until then, restrict granting access to the sync feature to trusted users only. Monitor administrative role assignments carefully. Patch status is not explicitly confirmed; check the vendor advisory for updates and official fixes.
Description
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.
Impact
An authenticated user with a low-privileged role, if granted access to the sync feature by an administrator, can overwrite critical plugin settings. This includes modifying which roles have access to the sync feature, potentially escalating privileges or disrupting plugin functionality. The vulnerability does not affect users without such granted access, and the role grant is not enabled by default.
Weaknesses
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.