InstaWP Connect CVE-2026-109400

Exploitation requires ALL of the following: (1) the attacker holds an authenticated account at Subscriber level or above; (2) the site is actively connected to InstaWP (a valid master API key exists in instawp_api_options); and (3) an administrator has added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles). A key limiting factor is that the settings tab is only suppressed when 'administrator' is entirely absent from the list - so a mixed configuration that retains administrator alongside a lower role still serves the full settings page and API key to the lower-privileged user, which is the exploitable state. This is a non-default, administrator-created condition, which is why realistic exposure is narrower than the CVSS base score alone suggests.

This is a genuine full-takeover privilege escalation (CWE-269) in InstaWP Connect for WordPress reported by Wordfence, but its real-world risk is moderate rather than critical because exploitation depends on a specific, non-default configuration. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly captures the tension: impact is maximal (C:H/I:H/A:H - a Subscriber becomes Administrator), the attacker needs only low privileges (PR:L) and no user interaction, but AC:H reflects the two preconditions that must both hold - the site must be actively connected to InstaWP, and an administrator must have added the attacker's role to the Sync Tab Access list (instawp_sync_tab_roles) in a mixed configuration that still exposes the API key. No EPSS score, KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the absence of these signals is consistent with a recently disclosed, config-dependent flaw rather than one under mass exploitation. Net: prioritize for sites running this plugin that match the vulnerable configuration, but AC:H and the PR:L authenticated prerequisite meaningfully narrow the exposed population versus a drive-by unauthenticated bug.

On a WordPress site actively connected to InstaWP where an administrator has added a low-privileged role to the Sync Tab Access list alongside administrator, an authenticated Subscriber opens the plugin settings page and reads the plaintext master API key rendered directly in a plain-text input. The attacker derives the SHA-256 secret, presents it as a bearer token to the plugin's REST API, and calls POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie, fully escalating to admin. No public exploit code is identified at time of analysis, but the attack path is fully described in the advisory and trivial to reproduce manually.