User Management Flaw in WP Remote Users Sync Plugin by WordPress
CVE-2026-123097
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 13 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-123097?
The WP Remote Users Sync plugin for WordPress versions before 2.2.1 contains a significant security flaw that permits unauthorized account field changes. Unsanctioned sites holding synchronization keys can create or update user profiles, resulting in the ability to assign administrator roles, alter existing accounts, and inject arbitrary user metadata. This compromises user role restrictions and metadata protocols, posing a severe risk to site integrity.
Affected Version(s)
WP Remote Users Sync 0 < 2.2.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.