High severity8.5NVD Advisory· Published Aug 16, 2023· Updated Apr 8, 2026
CVE-2023-3958
CVE-2023-3958
Description
The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.
Affected products
1- cpe:2.3:a:froger:wp_remote_users_sync:*:*:*:*:*:wordpress:*:*Range: <1.2.13
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- plugins.trac.wordpress.org/changeset/2946667/wp-remote-users-syncnvdPatch
- plugins.trac.wordpress.org/changeset/2953845/wp-remote-users-syncnvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/2e78c759-4a54-4ee4-8eff-df91fe9dad46nvdThird Party Advisory
- plugins.trac.wordpress.org/browser/wp-remote-users-sync/trunk/inc/api/class-wprus-api-abstract.phpnvdProduct
News mentions
0No linked articles in our index yet.