Description
The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, including reassigning content authorship.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Sync Post With Other Site | 1.9.3 – < 1.9.4 | 1.9.4 |
References
- https://wpscan.com/vulnerability/5c68dd50-96a3-414c-8060-9f70bb87766f/ exploit vdb-entry technical-description