CVE-2023-3958CWE-918

WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery

High · published August 16, 2023

CVSS v3.1
8.5
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00735 · 53.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2023-08-16T04:36Z
EPSS history
Timeline
  • 16 AUG 04:36Z
    WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery
    cvelistv5