Technical impact
The vulnerability exists in the InstaWP Connect WordPress plugin before version 0.1.4.2. No capability check is performed when the plugin processes a settings update through the instawp_update_settings action, relying only on a nonce. As a result, an authenticated user who has been granted a low‑privileged role by an administrator can override the plugin’s settings, including the control that determines which roles may access the sync feature. This allows the attacker to alter configuration and potentially elevate privileges or disable security controls within the WordPress site.
Affected Systems
Any WordPress installation that has the InstaWP Connect plugin installed and actively used and is running a version earlier than 0.1.4.2. The plugin is maintained by an unnamed developer. No other product versions or vendors are listed in the CVE data.
Risk and Exploitability
The lack of an access‑control check means the exploit can be carried out by any logged‑in user with a role that the site owner has trusted for this plugin. Because the attacker only needs to trigger a standard settings update, the exploit is straightforward for a legitimate user. The CVSS score is 3.1, and the EPSS score is < 1%; the vulnerability is listed as not present in the CISA KEV catalog. The risk is therefore primarily local to the administrator’s WordPress environment and depends on how many users have been granted access to the plugin’s sync feature.
