CVE-2026-114743: InstaWP Connect settings update missing authorization check

CVE-2026-114743 · Severity: info · Published 2026-10-25

InstaWP Connect is a WordPress plugin that synchronizes site configuration and access settings. An authenticated user with a low-privileged role can modify the plugin's settings—including role access controls—if an administrator has granted them sync feature access, because the plugin only validates a security token rather than confirming the user has permission. This could allow privilege escalation and unauthorized feature access.

Technologies: InstaWP Connect. Vendors: InstaWP.

Quick answers

Is CVE-2026-114743 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114743 being exploited in the wild.
How severe is CVE-2026-114743?
Informational severity, published 25 October 2026.
Which products and versions are affected?
InstaWP Connect before 0.1.4.2.
Is there a fix for CVE-2026-114743?
Yes: fixed in 0.1.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114743 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-114743?
Check whether you run InstaWP Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 0.1.4.2

Technical details

The plugin's settings update handler (instawp_update_settings) verifies a nonce but fails to check WordPress capabilities before allowing modifications. An authenticated attacker with a low-privileged role who has been granted sync access can call this action to overwrite plugin settings, including role-based access controls. The vulnerability requires prior admin grant of sync access, which is disabled by default.

Affected products

  • InstaWP InstaWP Connect before 0.1.4.2

Timeline

  • 2026-10-23: disclosed
  • 2026-10-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.