CVE-2026-110132: Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and Modification

Published Nov 8, 2026

Updated

The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, including reassigning content authorship.

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which users can exploit this issue?

Any user with Contributor-level access or higher can exploit it. The issue is an authorization flaw affecting content-management actions for post types other than pages.

What could an attacker do after exploiting it?

An authenticated attacker can create and modify arbitrary custom post types. They can also reassign content authorship.

Which plugin versions are affected?

Versions before 1.9.4 are affected. Updating to version 1.9.4 or later addresses the affected version range.

Is public, unauthenticated access required for exploitation?

No. Exploitation requires an account with at least the Contributor role; the provided information does not indicate unauthenticated exploitation.

CVE-2026-110132: Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and Modification

Event History

Frequently Asked Questions

Which users can exploit this issue?

What could an attacker do after exploiting it?

Which plugin versions are affected?

Is public, unauthenticated access required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What could an attacker do after exploiting it?

Which plugin versions are affected?

Is public, unauthenticated access required for exploitation?