The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability (such as a Contributor) can create, publish, and overwrite arbitrary Pages, including modifying content authored by higher-privileged users.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Sync Post With Other Site Plugin | — | Update sync-post-with-other-site plugin to version 1.9.3, or a newer patched version | Aug 5, 2026 | Jul 30, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub