InstaWP Connect CVE-2026-73401

No special configuration is required beyond the plugin being installed and active on a publicly reachable WordPress site running InstaWP Connect version 0.1.3.7 or earlier. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against any default installation of the affected plugin versions with no prerequisite privileges or user interaction. Exploitation is limited in impact to integrity modifications (I:L); the attacker cannot read sensitive data (C:N) or disrupt availability (A:N). Sites with the plugin deactivated or removed are not exposed. The specific endpoint(s) and the exact scope of unauthorized actions an attacker can perform are not described in the available source data - this detail is not independently confirmed beyond the Patchstack report.

The NVD-assigned CVSS 3.1 score of 5.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N, UI:N) flaw with unchanged scope (S:U) and limited integrity-only impact (I:L, C:N, A:N). The combination of PR:N and AC:L is the most operationally significant signal here: any internet-connected WordPress installation running this plugin is directly reachable. However, the impact ceiling is bounded by I:L - the attacker can modify data or trigger actions but cannot read confidential data or disrupt availability. No EPSS score was provided in the source data, so exploitation probability cannot be quantitatively assessed. The vulnerability is not in CISA KEV, and no POC has been identified, suggesting opportunistic mass exploitation has not yet materialized. Real-world priority is moderate: WordPress plugin broken-access-control flaws are routinely targeted by automated scanners, making the absence of authentication a meaningful risk multiplier even at medium CVSS.

An unauthenticated attacker discovers a WordPress site with the InstaWP Connect plugin installed by fingerprinting the plugin via standard enumeration techniques. The attacker then crafts an HTTP request directly targeting the unprotected plugin endpoint - requiring no session token or nonce - and triggers a restricted action such as modifying plugin configuration or initiating a site connection event, achieving low-level integrity impact without any credentials. No public proof-of-concept code has been identified at time of analysis, but the attack pattern is consistent with automated WordPress scanner tooling widely available in the threat actor community.