Sync Post With Other Site CVE-2026-32463

Exploitation requires an authenticated WordPress account with at least Contributor privileges on a site running Sync Post With Other Site version 1.9.3 or earlier (PR:L in the CVSS vector), and the ability to reach the plugin's file-upload handler over the network (AV:N) with no victim interaction (UI:N). The concrete prerequisite is the plugin's arbitrary-file-upload endpoint being active and the uploaded script being executable by the web server (typical PHP/Apache or PHP-FPM configuration). Limiting factors: the site must allow Contributor-level (or higher) account access - sites with registration disabled and no untrusted contributors materially reduce exposure - and hardening that blocks PHP execution in the uploads path would prevent the upload from reaching code execution.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9 Critical) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with total confidentiality, integrity, and availability impact across a changed scope - consistent with file-upload-to-RCE. The key risk-tempering signal is PR:L: an attacker must first obtain a Contributor account, so this is not fully unauthenticated; however, Contributor is a low-trust role often granted for guest posting and self-service registration, so the barrier is modest. EPSS was not provided in the input and cannot be cited. This CVE is not in CISA KEV and no POC was supplied, so there is no evidence of active or automated exploitation yet - but the class of bug is trivially weaponizable once an account is obtained, so it should be treated as a real, high-priority issue rather than a theoretical high-CVSS score. Note the reported 9.9 is at the very top of the range for a PR:L flaw and rests on the scope-change assumption; verify the execution path against your deployment.

An attacker registers or obtains a Contributor account on a WordPress site running Sync Post With Other Site 1.9.3 or earlier, then uses the plugin's upload functionality to submit a PHP webshell disguised as post media. Because the file type is not validated, the shell lands in a web-accessible directory; the attacker then browses to its URL to execute commands and take over the site. No public POC was supplied, but the attack requires only a standard authenticated HTTP request and low complexity.