CVE-2023-3958
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to and including 1.2.12. This allows authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations, potentially querying and modifying information from internal services.
Risk Assessment
Attackers can exploit this vulnerability to gain access to sensitive internal data or services, posing a significant security risk to the organization.
Recommendation
It is recommended to update the plugin to version 1.2.13 or later to mitigate this vulnerability.
Other vulnerabilities in WP Remote Users Sync plugin for WordPress
Original NVD description (English source)
The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS