Description

Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T14:17:13.407Z",
  "pubdate": "2026-08-13T14:17:13.407Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in the InstaWP Connect plugin affecting versions 0.1.3.7 and below.\nThis security flaw allows unauthenticated remote attackers to bypass authorization checks and interact with restricted functionalities exposed by the affected product.\nThe vulnerability poses significant risk implications, potentially leading to unauthorized data access, administrative actions, or state modifications within the underlying WordPress installation depending on the exposed endpoints.\nThe attacker capabilities are constrained only by the exposed API surface or functional routes lacking proper session validation or privilege verification.\nNo specialized privileges or user interaction are required for successful exploitation, lowering the attack barrier for malicious actors across network boundaries.",
  "technicalDetails": "The vulnerability stems from improper access control enforcement within the InstaWP Connect plugin codebase for versions <= 0.1.3.7.\nThe root cause lies in the failure of the affected component to adequately validate user sessions, roles, or capabilities before executing sensitive operations or servicing requests.\nThe vulnerable component comprises specific API endpoints, AJAX actions, or REST route handlers provided by the plugin that omit necessary authentication checks or capability verification routines such as current_user_can() or is_user_logged_in().\nBecause the affected endpoints lack these validation mechanisms, the attack surface is exposed directly to unauthenticated network traffic.\nThe attack flow proceeds as follows: 1) The attacker identifies the exposed InstaWP Connect endpoints through reconnaissance or static analysis of the plugin code. 2) The attacker crafts an HTTP request targeting these restricted functions without supplying any authentication tokens, cookies, or credentials. 3) The application receives the request, processes the input, and executes the underlying business logic or administrative functionality without validating the sender's identity or authorization level. 4) The server returns a success response or executes the requested unauthorized action.\nPost-exploitation impact varies depending on the specific capabilities exposed by the unprotected endpoints, potentially allowing unauthorized configuration changes, site management bypasses, or exposure of sensitive application data.\nThe vulnerability affects network-exposed HTTP interfaces and requires zero authentication and zero privilege levels to exploit against vulnerable InstaWP Connect installations."
}