# CVE-2026-109400: InstaWP Connect plugin privilege escalation via API key exposure

Source: https://junglewise.ai/threats/cve-2026-109400-the-instawp-connect-1-click-wp-staging-migration-plugin-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109400 · Severity: high · CVSS 7.5 · Published 2026-10-16

The InstaWP Connect plugin, used for staging and migrating WordPress sites, contains a privilege escalation flaw that exposes the master API key in plaintext to low-level users. Attackers with subscriber-level access can read the API key, use it to generate administrator login URLs, and fully compromise the affected WordPress site.

Technologies: [InstaWP Connect](https://junglewise.ai/threats/technologies/instawp-connect). Vendors: [InstaWP](https://junglewise.ai/threats/vendors/instawp).

## Quick answers

**Is CVE-2026-109400 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109400 being exploited in the wild.

**How severe is CVE-2026-109400?** High severity, with a CVSS score of 7.5, published 16 October 2026.

**Which products and versions are affected?** InstaWP Connect up to and including 0.1.4.1.

**Is there a fix for CVE-2026-109400?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109400 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109400?** Check whether you run InstaWP Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from insecure capability checking in the plugin's admin page registration and API key display. An authenticated attacker with subscriber privileges (or any role listed in the Sync Tab Access setting) can access the plugin settings page due to improper role validation, read the plaintext master API key from an HTML input field, derive the API secret, and call the REST API endpoint `POST /wp-json/instawp-connect/v2/auto-login` to obtain a temporary administrator authentication cookie.

## Affected products

- InstaWP InstaWP Connect up to and including 0.1.4.1

## Timeline

- 2026-10-16: disclosed

## Related threats

- [InstaWP Connect cross-site request forgery](https://junglewise.ai/threats/cve-2026-116399-cross-site-request-forgery-csrf-vulnerability-in-instawp-instawp)
- [InstaWP Connect settings update missing authorization check](https://junglewise.ai/threats/cve-2026-114743-the-instawp-connect-wordpress-plugin-before-0-1-4-2-does-not)
- [InstaWP Connect remote code execution via exposed encryption key](https://junglewise.ai/threats/cve-2026-13457-instawp-connect-remote-code-execution-via-exposed-encryption-key)
- [InstaWP InstaWP Connect missing authorization](https://junglewise.ai/threats/cve-2026-39504-instawp-instawp-connect-missing-authorization)