{"id":"CVE-2026-41558","published":"2026-10-06T06:17:01.370","lastModified":"2026-10-06T15:04:25.990","description":"Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpsynchro/vulnerability/wordpress-wp-migration-plugin-db-files-wp-synchro-plugin-1-16-1-2fa-bypass-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows authenticated attackers to bypass subscription restrictions in the WP Synchro plugin, potentially enabling unauthorized access to premium features or content. The flaw stems from improper validation of user subscriptions, making it a significant authentication bypass issue.","exploitability":"Exploitation requires an existing authenticated session with subscription privileges, making it moderately difficult to achieve without prior access but not overly complex once the initial foothold is established.","blast_radius":"If exploited, this vulnerability could allow attackers to access premium plugin features, potentially leading to unauthorized data access or modification across multiple WordPress sites using the vulnerable plugin version.","remediation":"Upgrade to WP Synchro version 1.16.2 or later to address the subscription bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","wp-plugin","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:01:06.712Z"}}