CVE-2026-111962 · Package
NO FIX YET · SEE WHAT TO DO
The WP Remote Users Sync plugin before 2.2.0 writes user export files under the public web root and protects them only with an Apache access file that Nginx ignores. An unauthenticated attacker who guesses the predictable file name can download the exported users' personal data.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the WP Remote Users Sync plugin older than 2.2.0 that export user data to the web root, especially on Nginx or any server that ignores Apache access files. Sites on Apache may still be protected by the access file, and sites without this plugin are not affected.
Not affected if no-user-export-used, plugin-2.2.0-or-later, plugin-not-installed
Who cares nginx, self-hosted, wordpress, wp-remote-users-sync
2.2.0.2.2.0 or later.The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.