# InstaWP Connect <= 0.1.4.2 - Unauthenticated Authentication Bypass to REST API Access Restrictions

- **ID:** WPSEC-2026-1837
- **Plugin:** InstaWP Connect – 1-click WP Staging & Migration (`instawp-connect`), https://wordpress.org/plugins/instawp-connect/
- **Affected versions:** all versions before 0.1.4.3
- **Fixed in:** 0.1.4.3 (Update to 0.1.4.3 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/instawp-connect
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1837/

## Description

The InstaWP Connect plugin for WordPress is vulnerable to an access control bypass in all versions up to, and including, 0.1.4.2. Its 'rest_authentication_errors' filter (priority 999) and its BuddyBoss endpoint-exclusion callback granted access to any request whose route, or raw request URI including the query string, merely contained the substring 'instawp-connect'. The plugin did not check that the route was in its own namespace or that the request carried valid InstaWP credentials, and the filter overwrote authentication errors raised by WordPress core and by other plugins. This makes it possible for unauthenticated attackers to bypass site-wide REST API restrictions set up by security, REST-restriction or BuddyBoss settings, for example by appending '?x=instawp-connect' to a core endpoint such as /wp/v2/users, and to bypass the Minimal Coming Soon maintenance mode, exposing data and functionality the site owner intended to block.

## References

- https://wpsec.com/vuln/WPSEC-2026-1837/
- https://plugins.svn.wordpress.org/instawp-connect/tags/0.1.4.3/
- https://wordpress.org/plugins/instawp-connect/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1837/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.