Syncee - Global Dropshipping < 1.0.10 - Authentication Token Disclosure
Description
The Syncee WordPress plugin before 1.0.10 leaks the administrator token that can be used to take over the administrator's account.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<1.0.10+ 1 more
- (no CPE)range: <1.0.10
- (no CPE)range: < 1.0.10
Package: https://wordpress.org/plugins/syncee
Patches
Vulnerability mechanics
Root cause
"The plugin exposes the administrator's authentication token without proper access controls, allowing unauthenticated disclosure of sensitive data."
Attack vector
An unauthenticated attacker can access a URL or endpoint in the Syncee plugin that leaks the administrator's authentication token [ref_id=1]. The plugin fails to restrict access to this sensitive data, so no authentication or special privileges are required to retrieve the token [CWE-200]. Once obtained, the token can be used to impersonate the administrator and take over the account [ref_id=1]. The attack requires only network access to the WordPress site and knowledge of the vulnerable endpoint.
Affected code
The advisory does not specify the exact file or function responsible for the leak. The vulnerable component is within the Syncee - Global Dropshipping plugin for WordPress, versions before 1.0.10 [ref_id=1].
What the fix does
The advisory states the vulnerability is fixed in version 1.0.10 of the Syncee plugin [ref_id=1]. No patch diff is provided in the bundle, but the fix presumably adds proper access controls to prevent unauthenticated access to the endpoint that exposes the administrator token. The remediation ensures that sensitive authentication data is only disclosed to authorized users.
Preconditions
- configThe target WordPress site must have the Syncee plugin installed and active in a version before 1.0.10.
- networkThe attacker must be able to make HTTP requests to the vulnerable endpoint on the WordPress site.
Reproduction
The advisory does not include explicit reproduction steps beyond stating that the plugin leaks the administrator token [ref_id=1]. The linked WPScan page is the same advisory and does not contain a step-by-step PoC.
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- wpscan.com/vulnerability/ad12bab7-9baf-4646-a93a-0d3286407c1emitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.