Wp Migration Plugin Db Files Wp Synchro
Monthly
Authentication bypass in WP Synchro (WP Migration Plugin DB & Files) through version 1.16.1 lets a low-privilege subscriber-level account defeat the plugin's two-factor authentication enforcement, resulting in high confidentiality, integrity, and availability impact on the affected WordPress site. The flaw is network-reachable but requires an existing authenticated account (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and carries high attack complexity, so it is not exploitable by a fully unauthenticated attacker and in practice favors sites that permit open user registration. No public exploit code was identified at time of analysis, and this is assessed as a moderate-priority issue rather than an urgent one.
Authentication bypass in WP Synchro (WP Migration Plugin DB & Files) through version 1.16.1 lets a low-privilege subscriber-level account defeat the plugin's two-factor authentication enforcement, resulting in high confidentiality, integrity, and availability impact on the affected WordPress site. The flaw is network-reachable but requires an existing authenticated account (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and carries high attack complexity, so it is not exploitable by a fully unauthenticated attacker and in practice favors sites that permit open user registration. No public exploit code was identified at time of analysis, and this is assessed as a moderate-priority issue rather than an urgent one.