The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1. This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holdin [truncated]
A Missing Authorization vulnerability was discovered in InstaWP Connect, affecting versions from n/a through 0.1.2.5. This issue allows for Exploiting Incorrectly Configured Access Control Security Levels, with a CVSS score of 5.4 and a severity of MEDIUM. The vulnerability has a significant impact on access control, potentially allowing unauthorized actions. Users should review their configurations and u [truncated]
