CVE-2026-111962VulnerabilityPublished 4 Nov 2026

The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it

Source GCVE Database

Compare

Authoritative record:CVE-2026-111962· High

Not known to be exploited : upgrade to 2.2.0 soon.

Data as of 4 Nov 2026, 07:29 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in 2.2.0

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 3 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-wmc8-xv69-488r

What to do

Upgrade WP Remote Users Sync to 2.2.0.

Affected software

Product	Affected	Fixed in
WP Remote Users Sync	Affected <2.2.0	Fixed in 2.2.0

AI-suggested

Upgrade the WP Remote Users Sync plugin to version 2.2.0 or later, where this issue is addressed. If upgrading is not immediately possible, restrict access to the export files using server configurations appropriate for the web server in use (e.g., Nginx rules) to prevent unauthorized access.

Description

The WP Remote Users Sync WordPress plugin versions before 2.2.0 improperly restrict access to user export files stored under the public web root. This issue arises because the plugin relies on an Apache-specific access control file, which is ineffective on other web servers like Nginx. Consequently, an unauthenticated attacker can access these export files by requesting their predictable filenames, potentially exposing personal user data.

Impact

An unauthenticated attacker can access user export files containing personal data by exploiting the inadequate access restrictions on these files. This exposure can lead to unauthorized disclosure of sensitive user information.

Summary

The WP Remote Users Sync WordPress plugin prior to version 2.2.0 does not adequately protect user export files it generates beneath the public web root. The plugin uses an Apache access-control file to restrict access, but this method is ineffective on web servers such as Nginx that do not honor Apache .htaccess files. This misconfiguration allows unauthenticated attackers to retrieve exported user data by requesting the files using predictable names while the files exist on the server.

References

Community reviews

Loading reviews…