WordPress Plugin Vulnerabilities

WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action

Description

The plugin does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.

Proof of Concept

Affects Plugins

Plugin icon
wp-remote-users-sync
Fixed in 2.3.0

References

CVE
CVE-2026-123092

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Turan Dadashzada
Submitter
Turan Dadashzada
Verified
Yes
WPVDB ID
31ed11db-eb07-4628-8ad8-5b545c6f8fe0

Timeline

Publicly Published
2026-11-10 (about 2 days ago)
Added
2026-11-10 (about 1 day ago)
Last Updated
2026-11-10 (about 1 day ago)

Other

Published
Title
Published
2026-10-30
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.6 - Authenticated (Contributor+) Privilege Escalation
Published
2026-11-02
Title
Uncanny Toolkit for LearnDash < 3.8.3 - Unauthenticated Privilege Escalation
Published
2026-10-06
Title
Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call
Published
2026-03-10
Title
ExactMetrics 7.1.0 - 9.0.2 - Improper Privilege Management to Role Privilege Escalation via Settings Update
Published
2020-05-13
Title
Site Kit by Google < 1.8.0 - Privilege Escalation to gain Search Console Access