InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-109400 · Microsoft / collected KEV context

cve-program · CVE-2026-109400

• https://www.wordfence.com/threat-intel/vulnerabilities/id/925b009e-3aeb-496d-8218-6ea5dc9d9989?source=cve
• https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L186
• https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/admin/class-instawp-admin.php#L153
• https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L91
• https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/apis/class-instawp-rest-api.php#L663
• https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-hooks.php#L194
• https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/functions.php#L1041
• https://plugins.trac.wordpress.org/changeset/3743786/instawp-connect/trunk/includes/class-instawp-setting.php

No related operational record is retained in the current change model.