The vulnerability in the User Sync – Remote User Sync plugin stems from a missing or incorrect nonce validation in the mo_user_sync_form_handler() function. Because the plugin fails to verify a request nonce, an attacker can craft a forged request that the system will accept as legitimate. This flaw allows an unauthenticated attacker—provided they can convince a site administrator to click a malicious link—to deactivate the plugin, resulting in loss of remote user synchronization and any services that depend on it. The weakness is a classic Cross‑Site Request Forgery flaw, classified as CWE‑352, which permits execution of privileged actions without proper authentication.

The affected system is the WordPress plugin User Sync – Remote User Sync from vendor cyberlord92. All releases up to and including version 1.0.2 are vulnerable; newer releases are not listed as affected.

The CVSS score of 4.3 places this issue in the moderate range, and the EPSS score of less than 1% indicates an extremely low likelihood of exploitation. The vulnerability is not included in CISA’s KEV catalog. Exploitation requires an attacker to deceive a site administrator into opening a crafted link, so social engineering is the primary prerequisite. While the exploitation probability is low, the potential denial of remote user synchronization could disrupt business operations, warranting a prompt patch.