WP Synchro EUVD-2026-92957

Exploitation requires an existing low-privilege authenticated account on the target site (PR:L, consistent with the 'Subscriber Bypass' naming), so it is not remotely exploitable by a fully unauthenticated attacker; in practice this favors sites that permit open user registration. The attacker must then defeat WP Synchro's two-factor authentication enforcement (CWE-290, authentication bypass by spoofing) on a vulnerable version (<= 1.16.1). Limiting factors: the high attack complexity (AC:H) indicates the bypass depends on specific conditions or timing rather than a single deterministic request, and sites that disable self-registration or do not expose the affected 2FA-protected functionality to subscriber-level users significantly reduce exposure.

This is a moderate-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable but high-complexity attack that requires the attacker to already hold a low-privilege authenticated account (PR:L) - consistent with the 'Subscriber Bypass' naming and the referenced 2FA-bypass classification under CWE-290 (Authentication Bypass by Spoofing). The combination of AC:H (non-trivial conditions to win the bypass) and PR:L (an existing subscriber account) materially lowers real-world likelihood compared to an unauthenticated remote flaw. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization; the single source is a Patchstack advisory. The stated C:H/I:H/A:H impacts are plausible because WP Synchro is a database/file migration plugin with access to the full site, but these high impacts only materialize if the 2FA bypass actually yields access to the plugin's privileged migration functions - the advisory text provided is too terse to confirm that chain, so treat the impact rating as vendor/reporter-asserted rather than independently verified. Net: a legitimately exploitable authentication-bypass bug worth patching promptly, but the authenticated prerequisite and high attack complexity argue against treating it as a drop-everything emergency absent exploitation signals.

A site allows open user registration (default WordPress subscriber role) or an attacker otherwise obtains a low-privilege account. The attacker then exploits a flaw in WP Synchro's two-factor authentication enforcement to bypass the 2FA check and gain access beyond their intended privilege level. No public exploit code was identified in the provided data, and the high attack complexity (AC:H) means the bypass depends on specific timing or conditions rather than a simple repeatable request.