---
id: "CVE-2026-111962"
kind: "vulnerability"
aliases: ["CVE-2026-111962"]
title: "WP Remote Users Sync WordPress plugin exposes exported user data publicly"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nginx", "package", "self-hosted", "wordpress", "wp-remote-users-sync"]
not_affected_if: ["no-user-export-used", "plugin-2.2.0-or-later", "plugin-not-installed"]
published_at: "2026-11-04T06:16:58+00:00"
first_seen_at: "2026-11-04T06:25:18+00:00"
updated_at: "2026-11-04T06:26:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111962", "first_seen_at": "2026-11-04T06:25:18+00:00"}]
---

# WP Remote Users Sync WordPress plugin exposes exported user data publicly

The WP Remote Users Sync plugin before 2.2.0 writes user export files under the public web root and protects them only with an Apache access file that Nginx ignores. An unauthenticated attacker who guesses the predictable file name can download the exported users' personal data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugins list; affected if older than `2.2.0`.
- On Nginx or other non-Apache servers, look for export files named predictably under the WordPress uploads or plugin directories and test whether they load in a browser without logging in.

## Fix

- WP Remote Users Sync: upgrade to `2.2.0` or later.

## Timeline

- 2026-11-04T06:25:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111962

## From the sources

The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_