Vulnerabilities and security researches forsync-post-with-other-site sync-post-with-other-site

Jun 06, 2024

CVE, Research URL: CVE-2024-32082
Home page URL: Security reports for Sync Post With Other Site
Application: Sync Post With Other Site
Date: Apr 15, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Kamlesh Parmar Sync Post With Other Site sync-post-with-other-site allows Cross Site Request Forgery.This issue affects Sync Post With Other Site: from n/a through <= 1.9.1.
Affected versions: max 1.5.2.
Status: vulnerable

Aug 04, 2024

CVE, Research URL: CVE-2024-6709
Home page URL: Security reports for Sync Post With Other Site
Application: Sync Post With Other Site
Date: Aug 03, 2024
Research Description: The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sps_add_update_post' function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new draft posts and update existing posts.
Affected versions: max 1.7.
Status: vulnerable

Aug 01, 2026

CVE, Research URL: CVE-2026-14923
Home page URL: Security reports for Sync Post With Other Site
Application: Sync Post With Other Site
Date: Jul 30, 2026
Research Description: The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability (such as a Contributor) can create, publish, and overwrite arbitrary Pages, including modifying content authored by higher-privileged users.
Affected versions: max 1.9.3.
Status: vulnerable