WP Remote Users Sync
WP Remote Users Sync has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2023; all 2 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 8.5 out of 10. Severity breakdown: 0 critical and 1 high. 2023 was the busiest year with 2 disclosures.
The most common weakness is Missing Authorization, behind 1 of the records (50%). Other recurring categories include Server-Side Request Forgery (SSRF).
Every one of the 2 issues recorded for WP Remote Users Sync has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by István Márton. WP Remote Users Sync is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2023-3958WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery
Read the full analysisVulnerability Records

WP Remote Users Sync
Author
Alexandre Froger
If you run multiple websites and want to keep users separated, but synchronise them automatically and securely for specific user operations, then WP Remote Users Sync is the plugin to use. Overview This plugin adds the following major features to WordPress: WP Remote Users Sync admin page: a settings page under “Settings > WP Remote Users Sync” to manage remote sites, security settings, import/export users, and view activity logs. Remote Sites: manage an unlimited amount of connected sites with configuration for incoming and outgoing User Actions (Login, Logout, Create, Update, Delete, Password, Role and Metadata). Security: WP Remote Users Sync is the only plugin available allowing users to be synchronised with true layers of security in place. All communications are OpenSSL AES-256-CBC encrypted, HMAC SHA256 signed, token-validated and IP-validated. Import and Export Users: connected websites’ existing user base can be synchronised manually first thanks to the provided import/export tool. Activity Logs: when enabled, all communications between connected sites are logged for admin review and troubleshooting. Synchronise all user data: compatible out of the box with WooCommerce, Ultimate Membership, Theme My Login, Gravity Forms, and all user-related plugins as long as they rely on WordPress user metadata and manipulate users with the WordPress user functions. Customizable: developers can add their own User Actions using action and filter hooks, and more – see the developers documentation. Unlimited websites, unlimited features: there are no restrictions in the number of websites to connect together, and no premium version feature restrictions shenanigans – WP Remote Users Sync is fully-featured right out of the box. Troubleshooting Please read the plugin FAQ, there is a lot that may help you there! WP Remote Users Sync is regularly updated for compatibility, and bug reports are welcome, preferably on Github. Pull Requests from developers following the WordPress Coding Standards (WordPress-Extra ruleset) are highly appreciated and will be credited upon merge. In case the plugin has not been updated for a while, no panic: it simply means the compatibility flag has not been changed, and it very likely remains compatible with the latest version of WordPress. This is because it was designed with long-term compatibility in mind from the ground up. Each bug report will be addressed in a timely manner if properly documented – previously unanswered general inquiries and issues reported on the WordPress forum may take significantly longer to receive a response (if any). Only issues occurring with included plugin features mentioned in “Synchronise all user data”, core WordPress and default WordPress themes (incl. WooCommerce Storefront) will be considered. Troubleshooting involving 3rd-party plugins or themes will not be addressed on the WordPress support forum. Integrations Although WP Remote Users Sync works out of the box with most combinations of WordPress plugins and themes, there are some edge cases necessitating integration, with code included in the core files of WP Remote Users Sync executing under certain conditions. Integrations added to core are limited to popular plugins and themes: any extra code specific to a handful of installations require a separate custom plugin not shared with the community (created and maintained by a third-party developer). A typical example necessitating custom integration includes plugins or themes relying on their own custom tables, directly updating the database with SQL queries instead of using WordPress built-in functions, destroying sessions with low-level functions instead of using the built-in WordPress method, etc. If such need for plugin integration arises, website administrators MUST contact a third-party developer. The plugin author currently does not have the bandwidth to take on custom work for WPRUS.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C