CVE-2026-114743 InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114743?
CVE-2026-114743 is a low-severity vulnerability in Unknown InstaWP Connect, published on 25 Oct 2026.
Official description
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.
Weakness: CWE-862
Which versions are affected by CVE-2026-114743?
How do I fix CVE-2026-114743?
No fix has been published for CVE-2026-114743 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114743 being exploited?
There is no known exploitation of CVE-2026-114743 in the wild and no public exploit code.
Sources
Also known as GHSA-587v-fw9w-xc4m.