High severity8.5NVD Advisory· Published Aug 16, 2023· Updated Jun 17, 2026
CVE-2023-3958
CVE-2023-3958
Description
The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:a:froger:wp_remote_users_sync:*:*:*:*:*:wordpress:*:*Range: <1.2.13
- Range: <=1.2.12
Patches
Vulnerability mechanics
References
4- plugins.trac.wordpress.org/changeset/2946667/wp-remote-users-syncnvdPatch
- plugins.trac.wordpress.org/changeset/2953845/wp-remote-users-syncnvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/2e78c759-4a54-4ee4-8eff-df91fe9dad46nvdThird Party Advisory
- plugins.trac.wordpress.org/browser/wp-remote-users-sync/trunk/inc/api/class-wprus-api-abstract.phpnvdProduct
News mentions
0No linked articles in our index yet.