---
id: "CVE-2026-123093"
page: "https://infrastack.ai/live/CVE-2026-123093"
kind: "vulnerability"
aliases: ["CVE-2026-123093"]
title: "WP Remote Users Sync plugin: any logged-in user can wipe activity log"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wp-remote-users-sync"]
not_affected_if: ["plugin-not-installed", "plugin-updated"]
published_at: "2026-11-13T06:16:53+00:00"
first_seen_at: "2026-11-13T06:42:16+00:00"
updated_at: "2026-11-13T06:42:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123093", "first_seen_at": "2026-11-13T06:42:16+00:00"}]
exploit_sources: []
---

# WP Remote Users Sync plugin: any logged-in user can wipe activity log

Link for people: https://infrastack.ai/live/CVE-2026-123093 (this .md is for agents)

The WP Remote Users Sync WordPress plugin before 2.2.1 has an AJAX action with no authorisation or CSRF check. Any logged-in user, including a subscriber, can delete the plugin's entire activity log.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of WP Remote Users Sync in the WordPress admin under Plugins; affected if below `2.2.1`

## Fix

- WP Remote Users Sync: `2.2.1`

## Timeline

- 2026-11-13T06:42:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123093

## From the sources

The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_