CVE-2026-123097: WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions
The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary user metadata, bypassing the receiving site's role and metadata restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Remote Users Syncto a version that resolves this vulnerability.Fixed in 2.2.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs the shared synchronisation keys used by a site configured to synchronise users with the affected receiving site. Those keys allow use of the plugin's create and update synchronisation actions.
What access could exploitation provide?
An attacker with the shared keys can assign the administrator role, modify any existing account, and write arbitrary user metadata on the receiving site. This bypasses that site's normal role and metadata restrictions.
Which deployments are exposed?
Receiving sites using WP Remote Users Sync versions before 2.2.1 are affected when another synchronised site holds the shared synchronisation keys. The issue applies to both user creation and user update synchronisation actions.