{"metadata": {"vulnerability": "CVE-2026-109400", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-12T14:41:13.867Z", "date_only": false, "value": "2026-10-12T14:41:13.867Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109400", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T14:55:53Z", "date_only": false, "value": "2026-10-12T14:55:53.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109400", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-15T15:51:06Z", "date_only": false, "value": "2026-10-15T15:51:06.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109400", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T04:27:01.115Z", "date_only": false, "value": "2026-10-16T04:27:01.115Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109400", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T04:27:01.115Z", "date_only": false, "value": "2026-10-16T04:27:01.115Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109400", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T04:49:47.827Z", "date_only": false, "value": "2026-10-16T04:49:47.827857Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117448781803302617", "record": "CVE-2026-109400", "field": "creation_timestamp", "uuid": "098f4044-da00-4811-ae08-f8899eba1a71", "content": "CVE-2026-109400 InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting The InstaWP Connect \u2013 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability \u2014 which WordPress resolves as a real capability match for any user holding that role \u2014 combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie \u2014 fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page \u2014 including the API key \u2014 to the lower-privileged user.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109400https://www.wordfence.com/threat-intel/vulnerabilities/id/925b009e-3aeb-496d-8218-6ea5dc9d9989?source=cvehttps://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L186https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/admin/class-instawp-admin.php#L153https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L91https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/apis/class-instawp-rest-api.php#L663https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-hooks.php#L194https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/functions.php#L1041https://plugins.trac.wordpress.org/changeset/3743786/instawp-connect/trunk/includes/class-instawp-setting.php#wordpress #instawp #InstaWPConnect\u20131-clickWPStaging&Migration#CVE_2026_109400#bot", "url": "https://infosec.exchange/users/cve/statuses/117448781803302617"}, {"timestamp": "2026-10-16T05:17:29Z", "date_only": false, "value": "2026-10-16T05:17:29Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FRVW-WVJH-GG5Q", "record": "GHSA-FRVW-WVJH-GG5Q", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T05:17:29.350Z", "date_only": false, "value": "2026-10-16T05:17:29.350", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109400", "record": "FKIE_CVE-2026-109400", "field": "published"}, {"timestamp": "2026-10-16T06:30:26Z", "date_only": false, "value": "2026-10-16T06:30:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FRVW-WVJH-GG5Q", "record": "GHSA-FRVW-WVJH-GG5Q", "field": "published"}, {"timestamp": "2026-10-16T06:30:26Z", "date_only": false, "value": "2026-10-16T06:30:26Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FRVW-WVJH-GG5Q", "record": "GHSA-FRVW-WVJH-GG5Q", "field": "modified"}, {"timestamp": "2026-10-16T15:45:59.923Z", "date_only": false, "value": "2026-10-16T15:45:59.923711Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109400", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T15:45:59.923Z", "date_only": false, "value": "2026-10-16T15:45:59.923711Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109400", "record": "FKIE_CVE-2026-109400", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T15:46:59.318Z", "date_only": false, "value": "2026-10-16T15:46:59.318Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109400", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:46:59.318Z", "date_only": false, "value": "2026-10-16T15:46:59.318Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109400", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T16:17:03.387Z", "date_only": false, "value": "2026-10-16T16:17:03.387", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109400", "record": "FKIE_CVE-2026-109400", "field": "lastModified"}]}