CVE-2023-3958highCWE-918

CVE-2023-3958: high-severity vulnerability in frogerme WP Remote Users Sync

WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery

Published · Updated

Follow this CVE+ Monitor WP Remote Users Sync

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.7%
The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Affected products
frogerme · WP Remote Users Sync
Related CVEs — frogerme WP Remote Users Sync

In the same product, most dangerous first.

CVE-2023-4374MEDIUMWP Remote Users Sync <= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log ViewEPSS 0.7%