Executive brief
The Sync Post With Other Site plugin for WordPress, which helps synchronize content between different websites, contains a security flaw in its authorization logic. This allows low-privileged users, such as Contributors, to create, publish, or modify website Pages that they should not have access to. An attacker could use this to deface a site, overwrite content created by administrators, or publish unauthorized information.
Technical details
An incorrect authorization vulnerability exists in the Sync Post With Other Site plugin due to an operator-precedence flaw in its capability checks. The vulnerability is located within the REST API route `/sps/v1/data` used for creating and updating posts. While the plugin intends to restrict page creation to users with 'edit_pages' permissions, the logic flaw allows any authenticated user with 'edit_posts' (such as the Contributor role) to bypass this check by specifying `post_type=page` in a POST request. Attackers can exploit this to create new published pages or overwrite existing ones, including those authored by higher-privileged users. The issue is fixed in version 1.9.3.
Affected products
- Unknown Sync Post With Other Site < 1.9.3
Timeline
- 2026-07-09: disclosed: Initial public disclosure via WPScan
- 2026-07-30: advisory: NVD publication date