EUVD-2026-50988
GHSA-pg99-759r-268m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
REST endpoint is network-reachable by authenticated contributors; impact is pure integrity (arbitrary page overwrite), not confidentiality, directly contradicting the supplied C:H/I:N assignment.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability (such as a Contributor) can create, publish, and overwrite arbitrary Pages, including modifying content authored by higher-privileged users.
AnalysisAI
Authenticated privilege escalation in the Sync Post With Other Site WordPress plugin (all versions before 1.9.3) allows any Contributor-level user to create, publish, and overwrite arbitrary Pages - including content authored by administrators - by exploiting an operator-precedence flaw in a REST route's authorization check. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile) and SSVC marks exploitation as non-automatable, suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing exists at time of analysis.
Technical ContextAI
The plugin exposes a WordPress REST API route for creating and synchronizing posts across sites. Its authorization gate contains a CWE-863 (Incorrect Authorization) defect rooted in operator-precedence: a logical expression - likely an unparenthesized mix of || and && - causes the capability check to short-circuit incorrectly, satisfying a page-edit requirement with only a post-edit capability. WordPress capability checks are binary capability comparisons passed as strings; a misplaced operator means the wrong capability wins evaluation. Affected product identified via CPE cpe:2.3:a:unknown:sync_post_with_other_site:*:*:*:*:*:*:*:* covering all versions prior to 1.9.3. The REST route presumably handles both creation and update operations, making both attack surfaces vulnerable simultaneously.
RemediationAI
Update to Sync Post With Other Site version 1.9.3 or later via the WordPress plugin dashboard or direct download; this release contains the corrected operator-precedence logic in the REST route authorization check. The vendor patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/cc635e60-f80e-4399-a016-9fde9228c58c/. If immediate upgrade is not possible, the most targeted compensating control is to temporarily deactivate the plugin via WP Admin > Plugins, which removes the vulnerable REST route entirely at the cost of disabling cross-site post sync functionality. Alternatively, site administrators can restrict Contributor-role registration or enforce a capability whitelist on REST endpoints using a capability-filtering plugin; however, this adds operational complexity and does not address the root flaw. Sites that do not use the plugin's cross-site sync feature should consider permanent removal.
More in Sync Post With Other Site
View allArbitrary file upload in the WordPress plugin Sync Post With Other Site (versions 1.9.3 and earlier) lets a user holding
The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today