{"id":"CVE-2026-123092","kind":"vulnerability","aliases":["CVE-2026-123092"],"related":[],"title":"WP Remote Users Sync plugin lets a remote site grant admin rights","description":"The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.","summary":"The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys incoming synchronisation requests may write. A site holding the shared synchronisation keys can set the capabilities of any existing account and raise it to administrator.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-remote-users-sync"],"not_affected_if":["plugin-2.3.0-or-later","remote-sync-disabled"],"how_to_check":"- Check the installed version of the WP Remote Users Sync plugin in the WordPress admin under Plugins, and treat anything below `2.3.0` as affected.\n- Confirm whether remote user synchronisation is configured on the site and which sites hold its shared keys.","fix":"- WP Remote Users Sync: upgrade to `2.3.0` or later.","status":"open","published_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:53+00:00","triaged_at":"2026-11-12T06:37:53+00:00","updated_at":"2026-11-12T06:37:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T06:37:53Z","model":"claude-haiku-5-5","output":{"fix":"- WP Remote Users Sync: upgrade to `2.3.0` or later.","reach":"network","title":"WP Remote Users Sync plugin lets a remote site grant admin rights","impact":"high","summary":"The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys incoming synchronisation requests may write. A site holding the shared synchronisation keys can set the capabilities of any existing account and raise it to administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-remote-users-sync","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker gains administrator rights on the WordPress site","analyst_note":"unknown","how_to_check":"- Check the installed version of the WP Remote Users Sync plugin in the WordPress admin under Plugins, and treat anything below `2.3.0` as affected.\n- Confirm whether remote user synchronisation is configured on the site and which sites hold its shared keys.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["remote-sync-disabled","plugin-2.3.0-or-later"],"who_is_affected":"Sites running the WP Remote Users Sync plugin before 2.3.0 that accept user synchronisation requests from remote sites. The exposure depends on a party holding the shared synchronisation keys, so sites without remote user sync configured are likely not reachable this way. unknown whether any sources detail further conditions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4545,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123092':15A,18A '-2026':14A,17A '2.3.0':37B,78C 'account':64B,111C 'admin':11A 'administr':69B,116C 'allow':95C 'capabl':60B,107C 'cve':13A,16A 'escal':113C 'exist':63B,110C 'grant':10A 'hold':52B,99C 'host':22B 'incom':45B,91C 'key':44B,56B,85C,103C 'let':6A 'may':48B,86C 'metadata':43B,84C 'packag':19B 'plugin':5A,35B,76C 'rais':66B 'remot':2A,8A,26B,31B,72C 'request':47B,94C 'restrict':40B,81C 'right':12A 'self':21B 'self-host':20B 'set':58B,105C 'share':54B,101C 'site':9A,51B,97C 'sync':4A,28B,33B,74C 'synchronis':46B,55B,93C,102C 'user':3A,27B,32B,42B,73C,83C,92C 'wordpress':23B,34B,75C 'wp':1A,25B,30B,71C 'wp-remote-users-sync':24B 'write':49B 'written':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Remote Users Sync plugin before 2.3.0 that accept user synchronisation requests from remote sites. The exposure depends on a party holding the shared synchronisation keys, so sites without remote user sync configured are likely not reachable this way. unknown whether any sources detail further conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress","wpremoteuserssync"],"campaign_type":null,"search_a":"'-123092':15A,18A '-2026':14A,17A 'admin':11A 'cve':13A,16A 'grant':10A 'let':6A 'plugin':5A 'remot':2A,8A 'right':12A 'site':9A 'sync':4A 'user':3A 'wp':1A","search_b":"'2.3.0':37B 'account':64B 'administr':69B 'capabl':60B 'exist':63B 'hold':52B 'host':22B 'incom':45B 'key':44B,56B 'may':48B 'metadata':43B 'packag':19B 'plugin':35B 'rais':66B 'remot':26B,31B 'request':47B 'restrict':40B 'self':21B 'self-host':20B 'set':58B 'share':54B 'site':51B 'sync':28B,33B 'synchronis':46B,55B 'user':27B,32B,42B 'wordpress':23B,34B 'wp':25B,30B 'wp-remote-users-sync':24B 'write':49B","search_c":"'2.3.0':78C 'account':111C 'administr':116C 'allow':95C 'capabl':107C 'escal':113C 'exist':110C 'hold':99C 'incom':91C 'key':85C,103C 'may':86C 'metadata':84C 'plugin':76C 'remot':72C 'request':94C 'restrict':81C 'set':105C 'share':101C 'site':97C 'sync':74C 'synchronis':93C,102C 'user':73C,83C,92C 'wordpress':75C 'wp':71C 'written':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123092","severity":null,"published_at":"2026-11-12T06:17:13+00:00","modified_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:53+00:00","fetched_at":"2026-11-12T06:36:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}