CVE-2026-109400
HighCVSS 7.5Summary
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress (versions up to and including 0.1.4.1) is vulnerable to privilege escalation. The plugin registers its admin page using a role name returned by InstaWP_Setting::get_allowed_role() as the required capability, and generate_section_field() renders the master API key as a plain-text HTML input without additional manage_options checks. An authenticated attacker with Subscriber-level access or above can read the plaintext master API key, use its SHA-256-derived secret as a bearer token in the plugin's REST API, and call POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie.
Risk Assessment
A low-privileged attacker can fully take over the WordPress site, gaining administrative access and performing any actions. This requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the Sync Tab Access list, though a mixed configuration retaining administrator alongside a lower role still exposes the API key.
Recommendation
Immediately update the InstaWP Connect plugin to a version newer than 0.1.4.1 if available, or disable it. Review and remove lower roles from the instawp_sync_tab_roles list and verify whether the API key has been exposed.
Related vulnerabilities
- CVE-2026-109515Critical
The MailOptin plugin for WordPress (versions up to and including 1.2.78.6) is vulnerable to privilege escalation. The subscribe_to_email_list endpoint accepts the optin_data[form_custom_field_mappings] parameter without validation, allowing an attacker to override the administrator's mapping and pass arbitrary wp_users columns (including ID and user_pass) to wp_insert_user().
- CVE-2026-109219Critical
The Mang Board plugin for WordPress (versions up to and including 2.4.4) is vulnerable to arbitrary file upload via the mbw_file_upload function. Missing file extension validation on the image_path parameter allows unauthenticated attackers to upload executable files, enabling remote code execution.
- CVE-2026-104798Critical
The My Calendar – Accessible Event Manager plugin for WordPress (versions up to and including 3.8.7) is vulnerable to privilege escalation. The mcs parameter is reflected unsanitized, allowing an unauthenticated attacker to inject a nested [my_calendar above=...] shortcode, which then calls arbitrary PHP functions via call_user_func(), including edit_user(), leading to administrator account takeover.
- CVE-2026-111444Critical
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. This includes opt-in parameterize=false queries, IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments, and LIKE ESCAPE literals.
- CVE-2026-111329Critical
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.
- CVE-2026-111322Critical
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.
- CVE-2026-111283Critical
BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.
- CVE-2026-111281Critical
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.
- CVE-2026-105039Critical
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
- CVE-2026-105038Critical
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.
Original NVD description (English source)
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS