CVE-2026-111962: WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File
The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Remote Users Syncto a version that resolves this vulnerability.Fixed in 2.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to public retrieval of the export file?
Sites running a version before 2.2.0 are exposed when the plugin writes user export files under the public web root and the web server does not enforce the Apache access-control file, such as Nginx.
What does an attacker need to exploit this issue?
No authentication or user interaction is required. The attacker must request the predictable export file name while the file is present.
What information could be disclosed?
The exported users' personal data could be retrieved from the publicly accessible export file.