WP Synchro – The Ultimate WordPress Migration Tool <= 1.16.1 - Unauthenticated Authentication Bypass via Compatibility MU Plugin Request Detection
- ID
- WPSEC-2026-2291
- Plugin
- WP Synchro – The Ultimate WordPress Migration Tool (wpsynchro)
- Affected
- all versions before 1.16.2
- Remediation
- Update to 1.16.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-288
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- WP Synchro – The Ultimate WordPress Migration Tool on WPSec AttackSurface
- Fix released
- Published
Also published later by Wpvulnerability as CVE-2026-41558, on 2026-10-06.
Description
The WP Synchro plugin for WordPress is vulnerable to Authentication Bypass via its compatibility must-use plugin in all versions up to, and including, 1.16.1. This is due to the MU plugin, which is installed and enabled by default, treating any request whose query string contains 'action=wpsynchro' as a WP Synchro service request whatever the request path, and unloading every other active plugin and the active theme for that request. This makes it possible for unauthenticated attackers to add the parameter to requests such as those to wp-login.php and so skip the protections that other plugins provide, such as two-factor authentication, login CAPTCHA and brute-force limits. Attackers who know a user's password can then log in without the second factor.
References
- https://wpsec.com/vuln/WPSEC-2026-2291/
- https://plugins.svn.wordpress.org/wpsynchro/tags/1.16.2/
- https://wordpress.org/plugins/wpsynchro/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS