InstaWP Connect EUVD-2026-109350

Exploitation requires ALL of the following: InstaWP Connect earlier than 0.1.4.2; an administrator must have explicitly granted a low-privileged role access to the plugin's sync feature, which the description states is NOT enabled by default; and the attacker must already hold such an account and supply a valid nonce for the settings-update action, which performs no capability check. The limiting factors are therefore the non-default role grant and the need for an existing authenticated low-privileged account - in a default configuration no low-privileged user can reach the vulnerable action, which substantially narrows real-world exposure below what the network attack vector alone suggests.

This is a genuinely low-priority issue, and every available signal agrees. The CVSS 3.1 base score is 3.1 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N: network-reachable but requiring high attack complexity, a low-privileged authenticated account, and yielding only limited integrity impact (no confidentiality or availability loss). EPSS is 0.17% (6th percentile), indicating very low predicted exploitation likelihood. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. A public PoC reference exists (the WPScan advisory) but it is not verified as working exploit code, so POC availability must not be read as active exploitation. The vuln.today decision label is 'monitor', consistent with all other signals. The AC:H rating is explained by the description's precondition rather than by any disclosed memory-corruption or timing mechanism: exploitation depends on a non-default configuration in which an administrator has explicitly granted a low-privileged role access to the plugin's sync feature. No signals conflict here - low CVSS, low EPSS, no KEV, and an unverified PoC all point the same direction.

On a site where an administrator has granted a low-privileged role access to InstaWP Connect's sync feature (not the default), a user holding that role submits the plugin's settings-update action with only a valid nonce and no capability check. Because the update includes the setting that controls which roles may access the sync feature, the attacker can rewrite plugin configuration and widen their own access. A public PoC reference exists via WPScan but is not verified as working exploit code.