WordPress WP Remote Users Sync plugin < 2.2.1 - Privilege Escalation to Administrator vulnerability

Privilege Escalation to Administrator vulnerability discovered by Md Jahid Bin Sabit in WordPress Plugin WP Remote Users Sync versions 2.2.1...

CVE-2026-123093

The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log...

CVE-2026-123097

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary use...

CVE-2026-123097

The WP Remote Users Sync WordPress plugin, in versions before 2.2.1 , contains a vulnerability where it fails to restrict which account fields a synchronized site can set during user creation or updates. An attacker possessing shared synchronization keys can exploit this to bypass role and metada...

EUVD-2026-124844

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary use...

CVE-2026-123097 WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary use...

CVE-2026-123093

The WP Remote Users Sync WordPress plugin, in versions prior to 2.2.1 , is vulnerable to an authorization and CSRF (Cross-Site Request Forgery) deficiency. This flaw exists in one of the plugin's AJAX actions , which allows any authenticated user, including those with low-level permissions like a...

WordPress WP Remote Users Sync plugin < 2.2.1 - Subscriber+ Activity Log Deletion vulnerability

Subscriber+ Activity Log Deletion vulnerability discovered by Aaron wellknown.info in WordPress Plugin WP Remote Users Sync versions 2.2.1...

EUVD-2026-124843

The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log...

CVE-2026-123093 WP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log Deletion

The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log...

PT-2026-146416

The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log...

PT-2026-146417

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary use...

WordPress WP Remote Users Sync plugin < 2.3.0 - Privilege Escalation to Administrator vulnerability

Privilege Escalation to Administrator vulnerability discovered by Turan Dadashzada in WordPress Plugin WP Remote Users Sync versions 2.3.0...

CVE-2026-123092

The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to...

CVE-2026-123092 WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action

The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to...

EUVD-2026-124280

The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to...

CVE-2026-123092

The WP Remote Users Sync WordPress plugin, in versions prior to 2.3.0 , is vulnerable to privilege escalation. The flaw exists because the plugin fails to restrict which user metadata keys can be written during incoming user synchronisation requests. An attacker who possesses the shared synchroni...

PT-2026-145711

The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to...

CVE-2026-123092: Unknown WP Remote Users Sync: The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written…

The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to...

CVE-2026-111962

The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests th...