{"id":"CVE-2026-110132","kind":"vulnerability","aliases":["CVE-2026-110132"],"related":[],"title":"WordPress Sync Post plugin lets contributors alter other post types","description":"The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, including reassigning content authorship.","summary":"The Sync Post With Other Site WordPress plugin before 1.9.4 skips an authorization check for post types other than pages. A user with Contributor access or higher can create and change custom post types and reassign content authorship.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-1.9.4-or-later"],"how_to_check":"- Check the installed version of the Sync Post With Other Site plugin in the WordPress admin under Plugins.","fix":"- Move the Sync Post With Other Site plugin to `1.9.4` or later.","status":"open","published_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:23+00:00","updated_at":"2026-11-08T06:47:23+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-08T06:47:23Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Sync Post With Other Site plugin to `1.9.4` or later.","reach":"network","title":"WordPress Sync Post plugin lets contributors alter other post types","impact":"medium","summary":"The Sync Post With Other Site WordPress plugin before 1.9.4 skips an authorization check for post types other than pages. A user with Contributor access or higher can create and change custom post types and reassign content authorship.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Contributor users alter custom post types and reassign content authorship","analyst_note":"product_name not given; the affected plugin version range beyond 'before 1.9.4' is unknown.","how_to_check":"- Check the installed version of the Sync Post With Other Site plugin in the WordPress admin under Plugins.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-1.9.4-or-later"],"who_is_affected":"WordPress sites running the Sync Post With Other Site plugin before 1.9.4 where Contributor-level or higher accounts exist. Sites without this plugin or with it already at 1.9.4 or later are not affected. The sources do not say whether the flaw is reachable without an account.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4532,"output_tokens":528,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110132':13A,16A '-2026':12A,15A '1.9.4':31B,69C 'access':46B,91C 'action':78C 'allow':85C 'alter':7A 'arbitrari':98C 'author':34B,73C 'authorship':59B,105C 'chang':52B 'check':35B 'content':58B,76C,104C 'content-manag':75C 'contributor':6A,45B,89C 'contributor-level':88C 'creat':50B,95C 'custom':53B,99C 'cve':11A,14A 'higher':48B 'host':20B 'includ':102C 'let':5A 'level':90C 'manag':77C 'modifi':97C 'page':41B,84C 'plugin':4A,29B,67C 'post':3A,9A,24B,37B,54B,62C,80C,100C 'proper':72C 'reassign':57B,103C 'self':19B 'self-host':18B 'site':27B,65C 'skip':32B 'sync':2A,23B,61C 'type':10A,38B,55B,81C,101C 'user':43B,86C 'wordpress':1A,21B,28B,66C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Sync Post With Other Site plugin before 1.9.4 where Contributor-level or higher accounts exist. Sites without this plugin or with it already at 1.9.4 or later are not affected. The sources do not say whether the flaw is reachable without an account.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-110132':13A,16A '-2026':12A,15A 'alter':7A 'contributor':6A 'cve':11A,14A 'let':5A 'plugin':4A 'post':3A,9A 'sync':2A 'type':10A 'wordpress':1A","search_b":"'1.9.4':31B 'access':46B 'author':34B 'authorship':59B 'chang':52B 'check':35B 'content':58B 'contributor':45B 'creat':50B 'custom':53B 'higher':48B 'host':20B 'page':41B 'plugin':29B 'post':24B,37B,54B 'reassign':57B 'self':19B 'self-host':18B 'site':27B 'skip':32B 'sync':23B 'type':38B,55B 'user':43B 'wordpress':21B,28B","search_c":"'1.9.4':69C 'access':91C 'action':78C 'allow':85C 'arbitrari':98C 'author':73C 'authorship':105C 'content':76C,104C 'content-manag':75C 'contributor':89C 'contributor-level':88C 'creat':95C 'custom':99C 'includ':102C 'level':90C 'manag':77C 'modifi':97C 'page':84C 'plugin':67C 'post':62C,80C,100C 'proper':72C 'reassign':103C 'site':65C 'sync':61C 'type':81C,101C 'user':86C 'wordpress':66C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110132","severity":null,"published_at":"2026-11-08T06:17:04+00:00","modified_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}