# WP Synchro – The Ultimate WordPress Migration Tool <= 1.16.1 - Unauthenticated Authentication Bypass via Compatibility MU Plugin Request Detection

- **ID:** WPSEC-2026-2291
- **Plugin:** WP Synchro – The Ultimate WordPress Migration Tool (`wpsynchro`), https://wordpress.org/plugins/wpsynchro/
- **Affected versions:** all versions before 1.16.2
- **Fixed in:** 1.16.2 (Update to 1.16.2 or later.)
- **Severity:** High 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-288
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpsynchro
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2291/

## Description

The WP Synchro plugin for WordPress is vulnerable to Authentication Bypass via its compatibility must-use plugin in all versions up to, and including, 1.16.1. This is due to the MU plugin, which is installed and enabled by default, treating any request whose query string contains 'action=wpsynchro' as a WP Synchro service request whatever the request path, and unloading every other active plugin and the active theme for that request. This makes it possible for unauthenticated attackers to add the parameter to requests such as those to wp-login.php and so skip the protections that other plugins provide, such as two-factor authentication, login CAPTCHA and brute-force limits. Attackers who know a user's password can then log in without the second factor.

Also published later by wpvulnerability as CVE-2026-41558.

## References

- https://wpsec.com/vuln/WPSEC-2026-2291/
- https://plugins.svn.wordpress.org/wpsynchro/tags/1.16.2/
- https://wordpress.org/plugins/wpsynchro/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2291/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.