CVE-2026-123097 · Runtime
NO FIX YET · SEE WHAT TO DO
The WP Remote Users Sync WordPress plugin before 2.2.1 does not limit which account fields a synchronised site can set when creating or updating users. A site holding the shared synchronisation keys can assign the administrator role, change any existing account and write arbitrary user metadata.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the WP Remote Users Sync plugin before 2.2.1 that synchronise users with other WordPress sites. The risk is highest where a synchronised site or anyone holding its shared keys could be untrusted. Sites without this plugin are not affected.
Not affected if plugin-not-installed, version-2.2.1-or-later
Who cares self-hosted, wordpress, wp-remote-users-sync
2.2.1 is affected.2.2.1 or later.The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary user metadata, bypassing the receiving site's role and metadata restrictions.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.