Unrated severityNVD Advisory· Published Nov 12, 2026
CVE-2026-123092
CVE-2026-123092
Description
The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.3.0
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.