Sync Post With Other Site
Monthly
Arbitrary file upload in the WordPress plugin Sync Post With Other Site (versions 1.9.3 and earlier) lets a user holding only Contributor-level privileges upload files of any type, including PHP webshells, bypassing WordPress's normal media-type restrictions. Because the flaw carries a scope-changed CVSS 3.1 score of 9.9, a successful upload typically escalates to remote code execution and full site compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low authentication barrier and high impact make it a strong patch priority.
Authenticated privilege escalation in the Sync Post With Other Site WordPress plugin (all versions before 1.9.3) allows any Contributor-level user to create, publish, and overwrite arbitrary Pages - including content authored by administrators - by exploiting an operator-precedence flaw in a REST route's authorization check. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile) and SSVC marks exploitation as non-automatable, suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing exists at time of analysis.
The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sps_add_update_post' function in all versions up to,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Arbitrary file upload in the WordPress plugin Sync Post With Other Site (versions 1.9.3 and earlier) lets a user holding only Contributor-level privileges upload files of any type, including PHP webshells, bypassing WordPress's normal media-type restrictions. Because the flaw carries a scope-changed CVSS 3.1 score of 9.9, a successful upload typically escalates to remote code execution and full site compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low authentication barrier and high impact make it a strong patch priority.
Authenticated privilege escalation in the Sync Post With Other Site WordPress plugin (all versions before 1.9.3) allows any Contributor-level user to create, publish, and overwrite arbitrary Pages - including content authored by administrators - by exploiting an operator-precedence flaw in a REST route's authorization check. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile) and SSVC marks exploitation as non-automatable, suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing exists at time of analysis.
The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sps_add_update_post' function in all versions up to,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.