{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-109400/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:instawp:connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-109400"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InstaWP Connect (\u003c= 0.1.4.1)"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","web-application","cve-2026-109400"],"_cs_type":"advisory","_cs_vendors":["InstaWP"],"content_html":"\u003cp\u003eInstaWP Connect versions 0.1.4.1 and earlier are vulnerable to a critical privilege escalation flaw (CVE-2026-109400). The vulnerability stems from insecure registration of administrative pages via \u003ccode\u003eadd_management_page()\u003c/code\u003e, which improperly relies on roles as capabilities. Combined with a lack of authorization checks in \u003ccode\u003egenerate_section_field()\u003c/code\u003e, the plugin displays the site's plaintext master API key in the HTML source of the settings page to any user assigned to the plugin's Sync Tab Access list.\u003c/p\u003e\n\u003cp\u003eAn authenticated attacker - including those with low-level subscriber access - can extract this key, calculate the SHA-256-derived secret, and authenticate against the plugin's REST API endpoint. By interacting with the \u003ccode\u003ePOST /wp-json/instawp-connect/v2/auto-login\u003c/code\u003e endpoint, the attacker can generate a single-use login URL, granting them full administrative access to the WordPress site. This vulnerability is active in configurations where an administrator has included lower-privileged roles within the plugin settings' sync access list.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative compromise of the affected WordPress site. This allows attackers to install malicious plugins, exfiltrate sensitive site data, modify content, and perform further post-exploitation activities within the environment. Any WordPress site currently using InstaWP Connect 0.1.4.1 or earlier that has configured sync tab access for roles other than 'administrator' is at risk of unauthorized administrative session creation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the InstaWP Connect plugin to the latest version that patches CVE-2026-109400 immediately.\u003c/li\u003e\n\u003cli\u003eRestrict Sync Tab Access roles in the plugin settings to 'administrator' only, ensuring no lower-privileged roles have access to the plugin settings page.\u003c/li\u003e\n\u003cli\u003eMonitor webserver access logs for anomalous POST requests to the \u003ccode\u003e/wp-json/instawp-connect/v2/auto-login\u003c/code\u003e endpoint, particularly those originating from user accounts without administrator privileges.\u003c/li\u003e\n\u003cli\u003ePerform an audit of current WordPress user roles and verify that the plugin settings do not grant administrative access to non-admin users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:25:39Z","date_published":"2026-10-16T06:25:39Z","id":"https://feed.craftedsignal.io/briefs/2026-10-instawp-privilege-escalation/","summary":"The InstaWP Connect plugin for WordPress, versions 0.1.4.1 and earlier, contains a privilege escalation vulnerability allowing authenticated users to extract the master API key and mint administrator session tokens.","title":"Privilege Escalation in InstaWP Connect WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-instawp-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-109400","version":"https://jsonfeed.org/version/1.1"}