CVE-2026-109400 Privilege escalation in InstaWP Connect – 1-click WP Staging & Migration
Authenticated subscribers can escalate to administrator by reading the master API key from the settings page and using it to generate an admin login URL.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109400?
CVE-2026-109400 is a high-severity vulnerability in InstaWP Connect – 1-click WP Staging & Migration, published on 16 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.
Weakness: CWE-269
Which versions are affected by CVE-2026-109400?
How do I fix CVE-2026-109400?
No fix has been published for CVE-2026-109400 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-109400 being exploited?
There is no known exploitation of CVE-2026-109400 in the wild and no public exploit code.
Sources
Also known as GHSA-frvw-wvjh-gg5q.