Threats tagged 'ghsa-mc56-vr34-8757'

The WP Remote Users Sync WordPress plugin versions before 2.2.1 allow a synchronized site with shared keys to set any user account fields without restriction. This includes assigning administrator roles, modifying existing accounts, and writing arbitrary user metadata, bypassing role and metadata restrictions on the receiving site.