CVE-2026-14923 is an incorrect authorization vulnerability (CWE-863) in the Sync Post With Other Site WordPress plugin prior to version 1.9.3. The flaw arises from an operator-precedence mistake in the authorization logic of a REST API endpoint responsible for creating and updating posts. As a result, authenticated users with limited post-editing capabilities can bypass restrictions to create, publish, and overwrite Pages, including those authored by users with higher privileges.

An attacker with authenticated access and the post-editing capability (e.g., Contributor role) can escalate their privileges to create and publish Pages arbitrarily, potentially modifying content authored by higher-privileged users. This could lead to unauthorized content manipulation and integrity loss of site pages. There is no indication of impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assignment of post-editing capabilities to trusted users only and monitor for unusual content changes. Avoid granting Contributor or similar roles to untrusted users.