CVE-2026-41558: CWE-290 Authentication Bypass by Spoofing in WP Synchro WP Migration Plugin DB & Files – WP Synchro

CVE-2026-41558 is a CWE-290 authentication bypass vulnerability in WP Migration Plugin DB & Files – WP Synchro versions up to 1.16.1. It allows an attacker with low privileges to bypass subscriber authentication controls, resulting in unauthorized access. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker can bypass subscriber authentication, potentially gaining unauthorized access to sensitive data and control over the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Users should monitor vendor communications for updates and consider restricting access to the plugin until a fix is released.