{"id":"CVE-2026-111962","kind":"vulnerability","aliases":["CVE-2026-111962"],"related":[],"title":"WP Remote Users Sync WordPress plugin exposes exported user data publicly","description":"The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data.","summary":"The WP Remote Users Sync plugin before 2.2.0 writes user export files under the public web root and protects them only with an Apache access file that Nginx ignores. An unauthenticated attacker who guesses the predictable file name can download the exported users' personal data.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nginx","package","self-hosted","wordpress","wp-remote-users-sync"],"not_affected_if":["no-user-export-used","plugin-2.2.0-or-later","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugins list; affected if older than `2.2.0`.\n- On Nginx or other non-Apache servers, look for export files named predictably under the WordPress uploads or plugin directories and test whether they load in a browser without logging in.","fix":"- WP Remote Users Sync: upgrade to `2.2.0` or later.","status":"open","published_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","triaged_at":"2026-11-04T06:26:29+00:00","updated_at":"2026-11-04T06:26:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T06:26:29Z","model":"claude-haiku-5-5","output":{"fix":"- WP Remote Users Sync: upgrade to `2.2.0` or later.","reach":"internet","title":"WP Remote Users Sync WordPress plugin exposes exported user data publicly","impact":"high","summary":"The WP Remote Users Sync plugin before 2.2.0 writes user export files under the public web root and protects them only with an Apache access file that Nginx ignores. An unauthenticated attacker who guesses the predictable file name can download the exported users' personal data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-remote-users-sync","nginx","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated users download exported personal data of site users","analyst_note":"Confirm the affected version range and whether the export file name is predictable in practice; NVD entry only, no vendor advisory was provided.","how_to_check":"- Check the installed plugin version in the WordPress admin plugins list; affected if older than `2.2.0`.\n- On Nginx or other non-Apache servers, look for export files named predictably under the WordPress uploads or plugin directories and test whether they load in a browser without logging in.\n- unknown for any further check the sources do not describe.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-2.2.0-or-later","no-user-export-used"],"who_is_affected":"Sites running the WP Remote Users Sync plugin older than 2.2.0 that export user data to the web root, especially on Nginx or any server that ignores Apache access files. Sites on Apache may still be protected by the access file, and sites without this plugin are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4140,"output_tokens":627,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111962':14A,17A '-2026':13A,16A '2.2.0':36B,82C 'access':53B,87C,105C 'access-control':104C 'adequ':85C 'allow':117C 'apach':52B,103C 'attack':60B,120C 'beneath':95C 'control':106C 'cve':12A,15A 'data':10A,73B,139C 'download':68B 'export':8A,39B,70B,91C,124C,136C 'expos':7A 'file':40B,54B,65B,92C,107C,127C 'guess':62B 'host':22B 'ignor':57B,115C 'name':66B,128C 'nginx':18B,56B,114C 'packag':19B 'person':72B,138C 'plugin':6A,34B,80C 'predict':64B,126C 'present':132C 'protect':47B 'public':11A,43B,97C 'reli':100C 'remot':2A,26B,31B,76C 'request':122C 'restrict':86C 'retriev':134C 'root':45B,99C 'self':21B 'self-host':20B 'server':111C 'sync':4A,28B,33B,78C 'unauthent':59B,119C 'user':3A,9A,27B,32B,38B,71B,77C,90C,137C 'web':44B,98C,110C 'wordpress':5A,23B,79C 'wp':1A,25B,30B,75C 'wp-remote-users-sync':24B 'write':37B,94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Remote Users Sync plugin older than 2.2.0 that export user data to the web root, especially on Nginx or any server that ignores Apache access files. Sites on Apache may still be protected by the access file, and sites without this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","nginx","package","selfhosted","wordpress","wpremoteuserssync"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111962","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111962","severity":null,"published_at":"2026-11-04T06:16:58+00:00","modified_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","fetched_at":"2026-11-04T06:25:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}