CVE-2026-123093: falha de média gravidade em WP Remote Users Sync
WP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log Deletion
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3
The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Unknown · WP Remote Users SyncCVEs relacionadas — WP Remote Users Sync
No mesmo produto, das mais perigosas para as menos.
CVE-2026-111962LOWWP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export FileEPSS 0.3%CVE-2026-123092HIGHWP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync ActionEPSS 0.2%CVE-2026-123097HIGHWP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync ActionsEPSS —