CVE-2026-123093: WP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log Deletion
Published Nov 13, 2026
·Updated
The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log.
Event History
Nov 13, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
Description
Frequently Asked Questions
1
Who can delete the activity log?
Any authenticated WordPress user can trigger the affected AJAX action, including a user with only the Subscriber role.
2
What must an attacker have to exploit this issue?
The attacker needs an authenticated account on the WordPress site. The vulnerability involves missing authorization and CSRF checks for an AJAX action.
3
What is the impact of successful exploitation?
An attacker can delete the plugin's entire activity log, which may remove records useful for auditing or investigating user synchronization activity.
4
Which plugin versions are affected?
WP Remote Users Sync versions before 2.2.1 are affected.