CVE-2026-123097
WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary user metadata, bypassing the receiving site's role and metadata restrictions.
| Vendor | unknown |
| Product | wp remote users sync |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp remote users sync
Be the first to know when new unknown vulnerabilities affecting unknown wp remote users sync are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Remote Users Sync
0 < 2.2.1
References
Credits
Md Jahid Bin Sabit WPScan