CVE-2023-3958 json
WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery
published 2023-08-16 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-44583
- cvss
- 8.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.
Patch / fix
- froger wp_remote_users_sync 1.2.13
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected products
- frogerme WP Remote Users Sync
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
- Technology feeds
References
-
plugins.trac.wordpress.org
/changeset/2946667/wp-remote-users-sync#file127
patch
-
plugins.trac.wordpress.org
/changeset/2953845/wp-remote-users-sync#file0
patch
-
wordfence.com
/threat-intel/vulnerabilities/id/2e78c759-4a54-4ee4-8eff-df91fe9dad46?source=cve
third-party-advisory
-
plugins.trac.wordpress.org
/browser/wp-remote-users-sync/trunk/inc/api/class-wprus-api-abstract.php#L674
product
Sources
- CVE List CVE-2023-3958
- NVD CVE-2023-3958
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.