---
id: CVE-2026-114743
title: >-
  InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via
  instawp_update_settings
summary: >-
  The InstaWP Connect  WordPress plugin before 0.1.4.2 does not perform a
  capability check on its InstaWP Connect  WordPress plugin before
  0.1.4.2-settings update action, verifying only a nonce, allowing an
  authenticated user holding a low…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-862
product: InstaWP Connect
affected:
  - instawp_connect < 0.1.4.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-26T10:07:01.933539Z'
published: '2026-10-25'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T10:13:36.679Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114743'
references:
  - url: 'https://wpscan.com/vulnerability/b94671c5-c5b5-418d-ac9c-af21c7cbc6a4/'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06784
ingestedAt: '2026-10-25T22:08:29.962Z'
---

## Overview

The InstaWP Connect  WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect  WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect  WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect  WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.

## Affected

- `instawp_connect < 0.1.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.