Sync Post Plugin CVE-2026-14923

Requires a valid WordPress user account with at minimum the Contributor role (the built-in 'edit_posts' capability). The Sync Post With Other Site plugin must be installed and active in a version prior to 1.9.3 - the vulnerability lives specifically in the plugin's REST route handler, so it is inert if the plugin is deactivated or absent. No non-default WordPress configuration is required beyond the plugin being active. Exploitation is firmly bounded by the need for authenticated access: unauthenticated visitors cannot reach the vulnerable endpoint. Sites with open user registration or publicly issued Contributor credentials face a substantially lower effective barrier to exploitation than those with tightly controlled account provisioning.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) contains a likely error: it asserts high confidentiality impact with zero integrity impact, which directly contradicts the description (create, publish, overwrite Pages). The actual impact is integrity-dominant - page content manipulation - with no described confidentiality breach. This discrepancy should be verified with NVD or the vendor before using the CVSS score for prioritization decisions. EPSS at 0.15% (5th percentile) and SSVC's 'not automatable / partial impact' designation both point to low operational priority for most environments. The POC's existence raises the realistic exploitation ceiling, but the PR:L prerequisite (valid Contributor account) is a meaningful barrier. Sites with open user registration or shared Contributor credentials face materially higher risk than tightly managed installations.

An attacker with a Contributor account (obtainable via open registration, purchased access, or credential theft) sends a crafted REST API request to the plugin's post-create/update endpoint, targeting a published Page such as the site homepage or legal notice. The operator-precedence flaw causes the authorization check to incorrectly permit the operation, and the attacker overwrites the Page with attacker-controlled content - enabling defacement, phishing lure injection, or SEO poisoning. A public POC documented by WPScan reduces the technical expertise required to replicate this attack.