CVE-2026-14923: WordPress Sync Post Auth Bypass Flaw

CVE-2026-14923 Overview

CVE-2026-14923 affects the Sync Post With Other Site WordPress plugin in versions prior to 1.9.3. The plugin fails to correctly enforce the page-editing capability on a REST route that creates and updates posts. An operator-precedence flaw in the authorization check allows an authenticated user with only the post-editing capability, such as a Contributor, to create, publish, and overwrite arbitrary Pages. This includes modifying content authored by higher-privileged users like Editors and Administrators. The issue is a broken access control flaw in the plugin's REST API permission callback.

Critical Impact
Contributor-level authenticated users can create, publish, and overwrite arbitrary WordPress Pages, including content authored by Administrators.

Affected Products

Sync Post With Other Site WordPress plugin versions before 1.9.3
WordPress installations using this plugin with Contributor or higher-role users
Multi-site environments relying on this plugin for cross-site content synchronization

Discovery Timeline

2026-07-30 - CVE-2026-14923 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14923

Vulnerability Analysis

The vulnerability is a broken access control flaw affecting a WordPress REST API endpoint exposed by the plugin. The plugin registers a REST route responsible for creating and updating posts and pages. Its permission callback contains an operator-precedence flaw in the boolean logic that gates access. As a result, WordPress evaluates the capability check in a way that grants access to users holding only the standard post-editing capability, bypassing the required page-editing capability.

Any authenticated user with the edit_posts capability, which Contributors possess, can invoke the REST route. The route then performs operations that should be restricted to users with edit_pages or publish_pages. This gives a low-privileged user the ability to overwrite pages authored by Administrators and Editors, publish arbitrary content, and modify site structure.

Root Cause

The root cause is an operator-precedence error in the authorization check within the plugin's REST permission callback. When boolean operators are grouped incorrectly, a broader capability check short-circuits the stricter one, allowing the callback to return true for users who should be denied. This is a business logic flaw combined with broken access control on a sensitive REST endpoint.

Attack Vector

Exploitation requires authenticated access with at least the Contributor role. The attacker sends a crafted HTTP request to the plugin's REST endpoint that handles post and page creation or updates. Because the permission callback incorrectly evaluates the required capabilities, WordPress accepts the request. The attacker supplies a target post ID or page slug and arbitrary content, then the endpoint writes or overwrites the resource. See the WPScan Vulnerability Report for endpoint specifics and reproduction details.

Detection Methods for CVE-2026-14923

Indicators of Compromise

Unexpected creation or modification of Pages by low-privileged accounts, particularly users holding only the Contributor role.
REST API requests to the plugin's sync endpoint originating from accounts that should not have page-editing rights.
Revision history on Pages showing an author change from an Administrator or Editor to a Contributor account.
New published Pages that were not authorized by site administrators.

Detection Strategies

Audit the wp_posts and wp_postmeta tables for Pages recently edited by users lacking the edit_pages capability.
Enable WordPress REST API access logging and filter for requests to routes registered by the Sync Post With Other Site plugin.
Review web server access logs for POST and PUT requests to /wp-json/ routes exposed by the plugin, correlated with the authenticated user's role.

Monitoring Recommendations

Monitor plugin version inventory across WordPress deployments to identify installations below version 1.9.3.
Alert on any Page publication or update performed by accounts with the Contributor role.
Track REST API authentication patterns for anomalous activity from low-privileged accounts.

How to Mitigate CVE-2026-14923

Immediate Actions Required

Update the Sync Post With Other Site plugin to version 1.9.3 or later on all affected WordPress installations.
Audit existing Pages for unauthorized modifications and restore from backups where tampering is confirmed.
Review the Contributor user list and remove any unnecessary or dormant accounts.

Patch Information

The plugin author addressed the operator-precedence flaw in version 1.9.3. Administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin files directly. Details of the fix are referenced in the WPScan Vulnerability Report.

Workarounds

Deactivate the Sync Post With Other Site plugin until the update to 1.9.3 can be applied.
Restrict access to the WordPress REST API from unauthenticated and low-privileged sources using a web application firewall rule.
Temporarily downgrade Contributor accounts or restrict role assignment until the patch is applied.

bash

# Example WP-CLI commands to inventory and update the plugin
wp plugin list --name=sync-post-with-other-site --fields=name,status,version
wp plugin update sync-post-with-other-site --version=1.9.3
wp plugin deactivate sync-post-with-other-site