InstaWP Connect: Delegated sync access permits unauthorized settings changes
InstaWP Connect checks only a nonce, not a capability, when handling its settings-update action. A low-privileged authenticated user can overwrite settings, including which roles may access the sync feature, if an administrator has already granted that role sync access. This grant is not enabled by default, and the flaw is not established for every ordinary low-privilege account. The exact action identifier and settings parameter names are not disclosed in the export. Published affected versions: < 0.1.4.2.
- Component
- InstaWP Connect
- Plugin slug
instawp-connect- Affected
- < 0.1.4.2
- Safe version
0.1.4.2- Published
- Oct 25, 2026
- Weakness
- Not assigned
This CVE was published Oct 25, 2026 and is one of 19 known issues for this plugin.
Update, patch or deactivate.
Update InstaWP Connect to 0.1.4.2 or later. Enforce the appropriate settings-management capability separately from nonce validation, including for changes to allowed roles. Revoke unnecessary delegated sync access and review settings and role-access grants.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.