WordPress Plugin Vulnerabilities

WP Synchro – The Ultimate WordPress Migration Tool <= 1.16.1 - 2-Factor Authentication Bypass

Description

The WP Synchro – The Ultimate WordPress Migration Tool plugin for WordPress is vulnerable to 2-Factor Authentication Bypass in all versions up to, and including, 1.16.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass 2fa when logging in.

Affects Plugins

Plugin icon
wpsynchro
No known fix

References

CVE
CVE-2026-41558
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8278dd45-d450-4322-9a74-4494596ed737

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
336d6ff6-ffb4-4730-9715-50d2f05c0aba

Timeline

Publicly Published
2026-10-05 (about 12 days ago)
Added
2026-10-09 (about 7 days ago)
Last Updated
2026-10-09 (about 7 days ago)

Other

Published
Title
Published
2024-10-15
Title
UltimateAI <= 2.8.3 - Authentication Bypass
Published
2026-05-14
Title
Receive Notifications After Form Submitting – Form Notify for Any Forms < 1.1.11 - Unauthenticated Authentication Bypass via LINE OAuth Callback
Published
2026-10-08
Title
Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN
Published
2020-02-05
Title
Merge + Minify + Refresh < 1.10.8 - Authenticated Arbitrary File Delete
Published
2026-08-19
Title
User Registration PRO < 5.4.6 - Unauthenticated Privilege Escalation via Account Takeover