Vulnerabilities

Vulnerability · CVE-2026-109400

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is d…

Published Oct 16, 2026 · catalog updated Oct 16, 2026 · the affected product

Check if you run it

No confirmed exploitation is on record for CVE-2026-109400. EPSS is 0.35%. Act only if a listed version of the affected product is installed.

Severity

High7.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.35%

Remediation

Version ranges on file

Affected products

stated named in the record

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via using a role name returned by as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with rendering the master API key from the option directly as the attribute of a plain-text HTML input with no additional or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API , and call to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list ( ); notably, the settings tab suppression logic only hides the tab when is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.