Instawp Connect 1 Click Wp Staging Migration
Monthly
Privilege escalation in the InstaWP Connect - 1-click WP Staging & Migration WordPress plugin (all versions up to and including 0.1.4.1) lets any authenticated user at Subscriber level or above read the site's plaintext InstaWP master API key from a plugin settings page and redeem it for a full administrator session. The key is disclosed because the admin page is registered with a role name returned by InstaWP_Setting::get_allowed_role() in place of a real capability, and because generate_section_field() prints the master API key directly into a plain-text HTML input without a manage_options check; the attacker then derives the bearer secret from that key, satisfies the plugin's REST validate_api_request(), and calls POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie. Exploitation is not default-configured: it additionally requires the site to be actively connected to InstaWP (a valid master API key in instawp_api_options) and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles) while still retaining administrator in that list, so realistic exposure is narrower than the 7.5 base score implies. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); authentication requirements are authenticated (CVSS PR:L) with high attack complexity (AC:H).
Privilege escalation in the InstaWP Connect - 1-click WP Staging & Migration WordPress plugin (all versions up to and including 0.1.4.1) lets any authenticated user at Subscriber level or above read the site's plaintext InstaWP master API key from a plugin settings page and redeem it for a full administrator session. The key is disclosed because the admin page is registered with a role name returned by InstaWP_Setting::get_allowed_role() in place of a real capability, and because generate_section_field() prints the master API key directly into a plain-text HTML input without a manage_options check; the attacker then derives the bearer secret from that key, satisfies the plugin's REST validate_api_request(), and calls POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie. Exploitation is not default-configured: it additionally requires the site to be actively connected to InstaWP (a valid master API key in instawp_api_options) and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles) while still retaining administrator in that list, so realistic exposure is narrower than the 7.5 base score implies. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); authentication requirements are authenticated (CVSS PR:L) with high attack complexity (AC:H).