CVE-2026-123097: falha de alta gravidade em WP Remote Users Sync
WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
18Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5
The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary user metadata, bypassing the receiving site's role and metadata restrictions.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · WP Remote Users SyncCVEs relacionadas — WP Remote Users Sync
No mesmo produto, das mais perigosas para as menos.
CVE-2026-111962LOWWP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export FileEPSS 0.3%CVE-2026-123092HIGHWP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync ActionEPSS 0.2%CVE-2026-123093MEDIUMWP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log DeletionEPSS —