{"id":"CVE-2026-123092","aliases":["EUVD-2026-124280","GHSA-7pg5-q6xp-hc6p"],"status":"published","title":"WP Remote Users Sync \u003c 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action","description":"The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00169,"percentile":0.06396,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-11-12T06:00:08Z","modified":"2026-11-12T12:32:37Z","products":[{"vendor":"frogerme","product":"wp remote users sync"},{"vendor":"unknown","product":"wp remote users sync"}],"references":[{"url":"https://wpscan.com/vulnerability/31ed11db-eb07-4628-8ad8-5b545c6f8fe0/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123092"},{"url":"https://wpscan.com/vulnerability/31ed11db-eb07-4628-8ad8-5b545c6f8fe0"},{"url":"https://github.com/advisories/GHSA-7pg5-q6xp-hc6p"}],"sources":{"cve":[{"id":"CVE-2026-123092","title":"WP Remote Users Sync \u003c 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action","description":"The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.","status":"published","published":"2026-11-12T06:00:08.632Z","modified":"2026-11-12T11:22:35.225Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-12T12:42:25.726487Z"}],"euvd":[{"id":"EUVD-2026-124280","description":"The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.","status":"published","published":"2026-11-12T06:00:08Z","modified":"2026-11-12T11:22:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-12T12:33:35.098642Z"}],"ghsa":[{"id":"GHSA-7pg5-q6xp-hc6p","title":"The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys...","description":"The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.","status":"published","published":"2026-11-12T06:30:23Z","modified":"2026-11-12T12:32:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-12T12:41:04.410575Z"}],"nvd":[{"id":"CVE-2026-123092","description":"The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.","status":"published","published":"2026-11-12T06:17:13.023Z","modified":"2026-11-12T18:49:18.84Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-12T13:31:11.73784Z"}]}}