Privilege Escalation in InstaWP Connect Plugin for WordPress

CVE-2026-109400

What is CVE-2026-109400?

The InstaWP Connect plugin for WordPress exposes a vulnerability that allows authenticated users with Subscriber-level access and above to escalate their privileges. This issue arises from inadequate capability checks in the plugin's functionality, specifically through the handling of its admin pages and the rendering of sensitive data. Attackers could exploit this vulnerability to gain access to the master API key in plaintext, which can subsequently be leveraged to generate a single-use login URL granting administrative access. The exploitation requires specific conditions, including ongoing connections to InstaWP and configurations involving role management. This oversight underscores the importance of stringent capability validations to prevent unauthorized actions within admin functionalities.

References