WordPress Plugin Vulnerabilities

WP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log Deletion

Description

The plugin does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the plugin's entire activity log.

Proof of Concept

Affects Plugins

Plugin icon
wp-remote-users-sync
Fixed in 2.2.1

References

CVE
CVE-2026-123093

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Aaron (wellknown.info)
Submitter
Aaron (wellknown.info)
Submitter website
https://wellknown.info
Submitter twitter
wellknowninfo
Verified
Yes
WPVDB ID
d5082119-feab-4978-b975-fd86a91b68a0

Timeline

Publicly Published
2026-11-11 (about 17 hours ago)
Added
2026-11-11 (about 3 hours ago)
Last Updated
2026-11-11 (about 3 hours ago)

Other

Published
Title
Published
2025-12-20
Title
Editorial Calendar < 3.8.9 - Missing Authorization
Published
2026-09-17
Title
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images < 2.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action
Published
2026-05-21
Title
WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms < 1.8.5 - Missing Authorization
Published
2023-10-19
Title
WP EXtra < 6.3 - Missing Authorization to Export Settings
Published
2026-06-01
Title
WPC Product Bundles for WooCommerce < 8.5.4 - Missing Authorization