InstaWP Connect plugin: Cross-site request forgery
Summary
The WordPress plugin InstaWP Connect (instawp-connect) through version 0.1.4.2 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can make a logged-in privileged user perform actions they did not intend, if that user visits a malicious link or page. The attacker needs no account on the site, but user interaction is required. The description does not state which action can be forged, so the real impact is unknown.
Affected
- InstaWP Connect (instawp-connect) WordPress plugin, versions up to and including 0.1.4.2
Fixed in
- Update to version 0.1.4.3 or later (per the CNA; not yet confirmed by the vendor, verify before declaring a site patched)
Workaround
- Unknown. No vendor-confirmed workaround.
- Limit the number of WordPress administrators.
- Have administrators log out of wp-admin when not in use.
- Consider a web application firewall or virtual patching if available.
Exploitation
- Not known to be exploited.
- No public exploit known.
- EPSS: 0.17 % (percentile 6).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all WordPress sites with instawp-connect installed and record their versions.
- Update to the latest release from WordPress.org and confirm it is newer than 0.1.4.2.
- Check whether CVE-2026-114743 (missing capability check) is also addressed on the same sites.
- Review administrator accounts and the plugin's sync-related settings for unexpected changes.
- Monitor for unusual administrator activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB entry CVE-2026-116399 vuldb.com
- OffSeq Radar entry radar.offseq.com
- Strix CVE entry www.strix.ai
- WordPress.org plugin directory wordpress.org
- InstaWP plugin page instawp.com
- Related CVE-2026-114743 (HOL Guard) hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:18.
Original description (NVD)
Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.