CVE-2026-123093: medium-severity vulnerability in WP Remote Users Sync
WP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log Deletion
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3
The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · WP Remote Users SyncRelated CVEs — WP Remote Users Sync
In the same product, most dangerous first.
CVE-2026-111962LOWWP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export FileEPSS 0.3%CVE-2026-123092HIGHWP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync ActionEPSS 0.2%CVE-2026-123097HIGHWP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync ActionsEPSS —