CVE-2026-123097
INFO
Priority: 0.00
BB Relevance:
0/100
Published: 2026-11-13
Modified: 2026-11-13
First seen: 2026-11-13
Status: pending_score
Description
The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary user metadata, bypassing the receiving site's role and metadata restrictions.
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| Unknown | WP Remote Users Sync | 0 < 2.2.1 |