User Metadata Manipulation in WP Remote Users Sync Plugin for WordPress
CVE-2026-123092
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-123092?
The WP Remote Users Sync WordPress plugin, prior to version 2.3.0, contains a vulnerability that permits unrestricted access to user metadata keys. This flaw enables unauthorized users to manipulate user capabilities through incoming synchronization requests. Consequently, a malicious site can exploit shared synchronization keys to elevate any existing account’s privileges, potentially granting them administrative access without proper authorization.
Affected Version(s)
WP Remote Users Sync 0 < 2.3.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.