# CVE-2026-114743: InstaWP Connect settings update missing authorization check

Source: https://junglewise.ai/threats/cve-2026-114743-the-instawp-connect-wordpress-plugin-before-0-1-4-2-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-114743 · Severity: info · Published 2026-10-25

InstaWP Connect is a WordPress plugin that synchronizes site configuration and access settings. An authenticated user with a low-privileged role can modify the plugin's settings—including role access controls—if an administrator has granted them sync feature access, because the plugin only validates a security token rather than confirming the user has permission. This could allow privilege escalation and unauthorized feature access.

Technologies: [InstaWP Connect](https://junglewise.ai/threats/technologies/instawp-connect). Vendors: [InstaWP](https://junglewise.ai/threats/vendors/instawp).

## Quick answers

**Is CVE-2026-114743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114743 being exploited in the wild.

**How severe is CVE-2026-114743?** Informational severity, published 25 October 2026.

**Which products and versions are affected?** InstaWP Connect before 0.1.4.2.

**Is there a fix for CVE-2026-114743?** Yes: fixed in 0.1.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114743 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114743?** Check whether you run InstaWP Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.1.4.2

## Technical details

The plugin's settings update handler (instawp_update_settings) verifies a nonce but fails to check WordPress capabilities before allowing modifications. An authenticated attacker with a low-privileged role who has been granted sync access can call this action to overwrite plugin settings, including role-based access controls. The vulnerability requires prior admin grant of sync access, which is disabled by default.

## Affected products

- InstaWP InstaWP Connect before 0.1.4.2

## Timeline

- 2026-10-23: disclosed
- 2026-10-25: advisory

## References

- [https://wpscan.com/vulnerability/b94671c5-c5b5-418d-ac9c-af21c7cbc6a4/](https://wpscan.com/vulnerability/b94671c5-c5b5-418d-ac9c-af21c7cbc6a4/)

## Related threats

- [InstaWP Connect cross-site request forgery](https://junglewise.ai/threats/cve-2026-116399-cross-site-request-forgery-csrf-vulnerability-in-instawp-instawp)
- [InstaWP Connect plugin privilege escalation via API key exposure](https://junglewise.ai/threats/cve-2026-109400-the-instawp-connect-1-click-wp-staging-migration-plugin-for)
- [InstaWP Connect remote code execution via exposed encryption key](https://junglewise.ai/threats/cve-2026-13457-instawp-connect-remote-code-execution-via-exposed-encryption-key)
- [InstaWP InstaWP Connect missing authorization](https://junglewise.ai/threats/cve-2026-39504-instawp-instawp-connect-missing-authorization)