InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting

Overview

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via add_management_page() using a role name returned by InstaWP_Setting::get_allowed_role() as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with generate_section_field() rendering the master API key from the instawp_api_options option directly as the value attribute of a plain-text HTML input with no additional manage_options or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API validate_api_request(), and call POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles); notably, the settings tab suppression logic only hides the tab when administrator is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.

Affected

• connect_1-click_wp_staging_migration <= 0.1.4.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.