The InstaWP Connect – 1-click WP Staging & Migration plugin allows an authenticated user with Subscriber-level or higher access to view the master API key in plain text and use it to generate a short-lived administrator login link. Because the plugin registers its administrative page with a capability derived from a selected role, any user holding that role can reach the settings page and read the key. The key is then accepted by the plugin’s REST API, which can be called to mint a 30‑second single‑use admin login URL, fully elevating the attacker’s privileges. This flaw enables local privilege escalation within a WordPress site that uses this plugin.

Affected vendors include Instawp, with the InstaWP Connect plugin on all releases up to and including version 0.1.4.1. No specific operating system or WordPress core version is required, but the site must have the plugin installed and the attacker must hold a Subscriber or higher rôle. The vulnerability exists in the plugin’s admin page registration and its rendering of the API key, as well as the REST API endpoint that accepts the key as a bearer token.

The vulnerability has a CVSS score of 7.5, indicating a high severity. EPSS is not available, so the exploitation probability is not quantified, but the flaw is not listed in CISA’s KEV catalog. Exploitation requires that the site is connected to InstaWP and that an administrator has added the attacker’s role to the plugin’s Sync Tab Access list. The attacker can then create a short‑lived admin login URL, granting full administrative access. The attack vector is authenticated in‑role, and the attacker must first obtain or elevate to a Subscriber‑level role to reach the settings page.