CVE-2026-39504

MediumCVSS 5.4

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The InstaWP Connect plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.1.2.5.

Risk Assessment

An attacker can gain unauthorized access to administrative functions, potentially leading to full site takeover.

Recommendation

Immediately update the InstaWP Connect plugin to the latest available version.

Original NVD description (English source)

Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.2.5.