Inadequate Access Control in WP Remote Users Sync Plugin by WordPress
CVE-2026-111962
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 4 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111962?
The WP Remote Users Sync plugin for WordPress, prior to version 2.2.0, suffers from inadequate access controls, especially concerning the user export files stored beneath the public web root. The plugin depends on an Apache access-control file, which does not provide protection for servers such as Nginx. This oversight allows unauthenticated attackers to exploit predictable file names and access exported personal user data, leading to potential data breaches.
Affected Version(s)
WP Remote Users Sync 0 < 2.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.