{"affected":[{"defaultStatus":"unaffected","product":"WP Remote Users Sync","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.2.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-123093","cwes":["CWE-862","CWE-352"],"description":"The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/d5082119-feab-4978-b975-fd86a91b68a0/"}],"kev":null,"metrics":[],"modifiedAt":1794549607819,"publishedAt":1794549607819,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/d5082119-feab-4978-b975-fd86a91b68a0/"}],"remediation":[],"revision":"29106654103e60563fb7dc147ddf8245d5e82b23abdf8fbb591155ca7acb17e9","sources":[{"modifiedAt":1794549607819,"name":"CNA: WPScan","retrievedAt":1794550144587,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123093"}],"ssvc":null,"status":"published","title":"WP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log Deletion","updatedAt":1794550144587}