CVE-2026-123092: WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action

Q: Who can exploit this issue?

An attacker needs access to the shared synchronisation keys used by the plugin. With those keys, they can send incoming user synchronisation requests targeting an existing account.

Q: What is the impact of a successful exploit?

The attacker can write user metadata keys without restriction, including capabilities metadata. This can elevate any existing account to administrator.

Q: Which installations are affected?

WP Remote Users Sync versions before 2.3.0 are affected. The provided information does not identify any configuration requirement beyond use of the plugin's incoming user synchronisation and shared keys.

Q: What should be prioritized during triage?

Identify who has access to the shared synchronisation keys and treat exposure of those keys as a potential compromise path. Review existing accounts for unexpected administrator privileges or altered capability metadata.

Published Nov 12, 2026

Updated

The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WP Remote Users Sync WordPress plugin to a version that resolves this vulnerability.
Fixed in 2.3.0

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs access to the shared synchronisation keys used by the plugin. With those keys, they can send incoming user synchronisation requests targeting an existing account.

What is the impact of a successful exploit?

The attacker can write user metadata keys without restriction, including capabilities metadata. This can elevate any existing account to administrator.

Which installations are affected?

WP Remote Users Sync versions before 2.3.0 are affected. The provided information does not identify any configuration requirement beyond use of the plugin's incoming user synchronisation and shared keys.

What should be prioritized during triage?

Identify who has access to the shared synchronisation keys and treat exposure of those keys as a potential compromise path. Review existing accounts for unexpected administrator privileges or altered capability metadata.

CVE-2026-123092: WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of a successful exploit?

Which installations are affected?

What should be prioritized during triage?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of a successful exploit?

Which installations are affected?

What should be prioritized during triage?