CVE-2026-123092highCWE-269

CVE-2026-123092: high-severity vulnerability in WP Remote Users Sync

WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action

Published

Follow this CVE+ Monitor WP Remote Users Sync

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.5epss 0.2%
The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · WP Remote Users Sync
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WP Remote Users Sync

In the same product, most dangerous first.

CVE-2026-111962LOWWP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export FileEPSS 0.3%CVE-2026-123097HIGHWP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync ActionsEPSS —CVE-2026-123093MEDIUMWP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log DeletionEPSS —