An authenticated attacker - including those with low-level subscriber access - can extract this key, calculate the SHA-256-derived secret, and authenticate against the plugin's REST API endpoint. By interacting with the POST /wp-json/instawp-connect/v2/auto-login endpoint, the attacker can generate a single-use login URL, granting them full administrative access to the WordPress site. This vulnerability is active in configurations where an administrator has included lower-privileged roles within the plugin settings' sync access list.

Impact

Successful exploitation results in full administrative compromise of the affected WordPress site. This allows attackers to install malicious plugins, exfiltrate sensitive site data, modify content, and perform further post-exploitation activities within the environment. Any WordPress site currently using InstaWP Connect 0.1.4.1 or earlier that has configured sync tab access for roles other than 'administrator' is at risk of unauthorized administrative session creation.

Recommendation

• Update the InstaWP Connect plugin to the latest version that patches CVE-2026-109400 immediately.
• Restrict Sync Tab Access roles in the plugin settings to 'administrator' only, ensuring no lower-privileged roles have access to the plugin settings page.
• Monitor webserver access logs for anomalous POST requests to the /wp-json/instawp-connect/v2/auto-login endpoint, particularly those originating from user accounts without administrator privileges.
• Perform an audit of current WordPress user roles and verify that the plugin settings do not grant administrative access to non-admin users.