Unauthorized Access Vulnerability in WP Remote Users Sync Plugin by WordPress
CVE-2026-123093

Currently unrated

Key Information:

Vendor

WordPress
Status
WP Remote Users Sync
Vendor
CVE Published:
13 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-123093?

The WP Remote Users Sync plugin for WordPress, prior to version 2.2.1, exposes a serious security flaw due to missing authorization and Cross-Site Request Forgery (CSRF) checks in its AJAX actions. This vulnerability enables any authenticated user, including those with minimal roles like subscribers, to delete the entire activity log of the plugin, potentially leading to data loss and unauthorized manipulation of records.

Affected Version(s)

WP Remote Users Sync 0 < 2.2.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-123093 - Proof of Concept

References

https://wpscan.com/vulnerability/d5082119-feab-4978-b975-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aaron (wellknown.info)
WPScan
.