https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 07 Nov 2026 08:31:54 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114743 <p>The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2&#39;s sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2&#39;s settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.</p> <p>The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2&#39;s sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2&#39;s settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114743 https://db.gcve.eu/vuln/ghsa-587v-fw9w-xc4m <p>The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2&#39;s sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2&#39;s settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.</p> <p>The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2&#39;s sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2&#39;s settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.</p> https://db.gcve.eu/vuln/ghsa-587v-fw9w-xc4m