CVE-2026-123097: high-severity vulnerability in WP Remote Users Sync
WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5
The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary user metadata, bypassing the receiving site's role and metadata restrictions.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · WP Remote Users SyncRelated CVEs — WP Remote Users Sync
In the same product, most dangerous first.
CVE-2026-111962LOWWP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export FileEPSS 0.3%CVE-2026-123092HIGHWP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync ActionEPSS 0.2%CVE-2026-123093MEDIUMWP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log DeletionEPSS —