CVE-2026-123097
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 13, 2026
Vendor
unknown
Description
The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary user metadata, bypassing the receiving site's role and metadata restrictions.