CVE-2026-109400 (GCVE-0-2026-109400)
Vulnerability from cvelistv5
Published
2026-10-16 04:27
Modified
2026-10-16 15:46
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-269 - Improper Privilege Management
Summary
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.
References
Impacted products
Vendor Product Version
instawp InstaWP Connect – 1-click WP Staging & Migration Version: 0   ≤ 0.1.4.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109400",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:45:59.923711Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:46:59.318Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "InstaWP Connect \u2013 1-click WP Staging \u0026 Migration",
          "vendor": "instawp",
          "versions": [
            {
              "lessThanOrEqual": "0.1.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "thevietronin"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The InstaWP Connect \u2013 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability \u2014 which WordPress resolves as a real capability match for any user holding that role \u2014 combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin\u0027s REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie \u2014 fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker\u0027s role to the plugin\u0027s Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page \u2014 including the API key \u2014 to the lower-privileged user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T04:27:01.115Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/925b009e-3aeb-496d-8218-6ea5dc9d9989?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L186"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/admin/class-instawp-admin.php#L153"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L91"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/apis/class-instawp-rest-api.php#L663"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-hooks.php#L194"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/functions.php#L1041"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3743786/instawp-connect/trunk/includes/class-instawp-setting.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T14:55:53.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T15:51:06.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "InstaWP Connect \u003c= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via \u0027instawp_sync_tab_roles\u0027 Role-as-Capability Setting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109400",
    "datePublished": "2026-10-16T04:27:01.115Z",
    "dateReserved": "2026-10-12T14:41:13.867Z",
    "dateUpdated": "2026-10-16T15:46:59.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-109400\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T15:45:59.923711Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T15:46:51.939Z\"}}], \"cna\": {\"title\": \"InstaWP Connect \u003c= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via \u0027instawp_sync_tab_roles\u0027 Role-as-Capability Setting\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"thevietronin\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"instawp\", \"product\": \"InstaWP Connect \\u2013 1-click WP Staging \u0026 Migration\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"0.1.4.1\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-12T14:55:53.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-10-15T15:51:06.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/925b009e-3aeb-496d-8218-6ea5dc9d9989?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L186\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/admin/class-instawp-admin.php#L153\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L91\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/apis/class-instawp-rest-api.php#L663\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-hooks.php#L194\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/functions.php#L1041\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3743786/instawp-connect/trunk/includes/class-instawp-setting.php\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The InstaWP Connect \\u2013 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability \\u2014 which WordPress resolves as a real capability match for any user holding that role \\u2014 combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin\u0027s REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie \\u2014 fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker\u0027s role to the plugin\u0027s Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page \\u2014 including the API key \\u2014 to the lower-privileged user.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-269\", \"description\": \"CWE-269 Improper Privilege Management\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-10-16T04:27:01.115Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-109400\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-16T15:46:59.318Z\", \"dateReserved\": \"2026-10-12T14:41:13.867Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-10-16T04:27:01.115Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.