Privilege Escalation in InstaWP Connect WordPress Plugin

InstaWP Connect versions 0.1.4.1 and earlier are vulnerable to a critical privilege escalation flaw (CVE-2026-109400). The vulnerability stems from insecure registration of administrative pages via add_management_page(), which improperly relies on roles as capabilities. Combined with a lack of authorization checks in generate_section_field(), the plugin displays the site's plaintext master API key in the HTML source of the settings page to any user assigned to the plugin's Sync Tab Access list.

An authenticated attacker - including those with low-level subscriber access - can extract this key, calculate the SHA-256-derived secret, and authenticate against the plugin's REST API endpoint. By interacting with the POST /wp-json/instawp-connect/v2/auto-login endpoint, the attacker can generate a single-use login URL, granting them full administrative access to the WordPress site. This vulnerability is active in configurations where an administrator has included lower-privileged roles within the plugin settings' sync access list.

Impact

Successful exploitation results in full administrative compromise of the affected WordPress site. This allows attackers to install malicious plugins, exfiltrate sensitive site data, modify content, and perform further post-exploitation activities within the environment. Any WordPress site currently using InstaWP Connect 0.1.4.1 or earlier that has configured sync tab access for roles other than 'administrator' is at risk of unauthorized administrative session creation.

Recommendation

• Update the InstaWP Connect plugin to the latest version that patches CVE-2026-109400 immediately.
• Restrict Sync Tab Access roles in the plugin settings to 'administrator' only, ensuring no lower-privileged roles have access to the plugin settings page.
• Monitor webserver access logs for anomalous POST requests to the /wp-json/instawp-connect/v2/auto-login endpoint, particularly those originating from user accounts without administrator privileges.
• Perform an audit of current WordPress user roles and verify that the plugin settings do not grant administrative access to non-admin users.