← CVE index
Vulnerability record/PUBLISHED/Published Oct 25, 2026 06:00:21 UTC

CVE-2026-114743

The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.

Base scoreN/A/ 10
SeverityNoneCVSS unscored

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityNone
No CVSS vector is available for this record.

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityWPScan
Last updatedOct 25, 2026 06:00:21 UTC
PublishedOct 25, 2026 06:00:21 UTC
ReservedOct 22, 2026 03:36:25 UTC

Credits

  • Meher Sudhakar Abbireddi
  • WPScan