{
 "id": "WPSEC-2026-2291",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2291/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2291/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2291/index.md",
 "title": "WP Synchro – The Ultimate WordPress Migration Tool <= 1.16.1 - Unauthenticated Authentication Bypass via Compatibility MU Plugin Request Detection",
 "description": "The WP Synchro plugin for WordPress is vulnerable to Authentication Bypass via its compatibility must-use plugin in all versions up to, and including, 1.16.1. This is due to the MU plugin, which is installed and enabled by default, treating any request whose query string contains 'action=wpsynchro' as a WP Synchro service request whatever the request path, and unloading every other active plugin and the active theme for that request. This makes it possible for unauthenticated attackers to add the parameter to requests such as those to wp-login.php and so skip the protections that other plugins provide, such as two-factor authentication, login CAPTCHA and brute-force limits. Attackers who know a user's password can then log in without the second factor.",
 "plugin": {
  "slug": "wpsynchro",
  "name": "WP Synchro – The Ultimate WordPress Migration Tool",
  "full_name": "WP Synchro – The Ultimate WordPress Migration Tool",
  "wordpress_org": "https://wordpress.org/plugins/wpsynchro/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpsynchro/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpsynchro"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-288"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.16.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.16.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.16.2",
 "remediation": "Update to 1.16.2 or later.",
 "fix_released": "2026-10-31T20:00:13+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:31:33.614693+00:00",
 "also_published_as": {
  "source": "wpvulnerability",
  "cve": [
   "CVE-2026-41558"
  ],
  "published": "2026-10-06T00:00:00+00:00"
 },
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2291/",
  "https://plugins.svn.wordpress.org/wpsynchro/tags/1.16.2/",
  "https://wordpress.org/plugins/wpsynchro/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpsynchro",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}