---
id: CVE-2026-111962
title: >-
  WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via
  Public User Export File
summary: >-
  The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately
  restrict access to the user export files it writes beneath the public web
  root, relying on an Apache access-control file that other web servers such as
  Nginx igno…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-200
product: WP Remote Users Sync
affected:
  - wp_remote_users_sync < 2.2.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T14:05:33.651606Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:21.718Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111962'
references:
  - url: 'https://wpscan.com/vulnerability/52800086-7013-4bd0-85f9-a2d94d3b6ab7/'
tags:
  - cve.org
epss: 0.00263
epssPercentile: 0.18281
ingestedAt: '2026-11-05T21:36:00.369Z'
---

## Overview

The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data.

## Affected

- `wp_remote_users_sync < 2.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.