---
id: CVE-2026-114743
title: >-
  InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via
  instawp_update_settings
summary: >-
  The InstaWP Connect  WordPress plugin before 0.1.4.2 does not perform a
  capability check on its InstaWP Connect  WordPress plugin before
  0.1.4.2-settings update action, verifying only a nonce, allowing an
  authenticated user holding a low…
severity: none
cwe:
  - CWE-862
product: InstaWP Connect
affected:
  - instawp_connect < 0.1.4.2
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T06:00:21.676Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114743'
references:
  - url: 'https://wpscan.com/vulnerability/b94671c5-c5b5-418d-ac9c-af21c7cbc6a4/'
tags:
  - cve.org
epss: 0.00168
epssPercentile: 0.06088
ingestedAt: '2026-10-25T22:08:29.962Z'
---

## Overview

The InstaWP Connect  WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect  WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect  WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect  WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.

## Affected

- `instawp_connect < 0.1.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.