CVE-2026-109400

Name of the Vulnerable Software and Affected Versions InstaWP Connect versions prior to 0.1.4.2

Description An issue exists where the plugin registers its admin page using add management page() with a role name from InstaWP Setting::get allowed role() as the required capability. Because generate section field() renders the master API key from the instawp api options option as a plain-text HTML input without a manage options check, authenticated users with Subscriber-level access or higher can read the plaintext master API key. An attacker can then use the SHA-256-derived secret of this key as a bearer token accepted by the validate api request() function in the REST API. By calling the POST /wp-json/instawp-connect/v2/auto-login endpoint, the attacker can generate a 30-second single-use login URL that sets an administrator authentication cookie, resulting in full privilege escalation. This requires the site to be connected to InstaWP and the attacker's role to be included in the instawp sync tab roles list.

Recommendations Update InstaWP Connect to version 0.1.4.2 or later. As a temporary mitigation, remove any non-administrator roles from the instawp sync tab roles list to prevent lower-privileged users from accessing the settings page.