Based on the description, it is inferred that the plugin’s authorization checks are insufficient for custom post types, enabling privileged content manipulation. The Sync Post With Other Site WordPress plugin prior to version 1.9.4 fails to enforce proper authorization for content‑management actions involving custom post types. Users with Contributor level or higher can create new custom post types, modify existing ones, and reassign content authorship, effectively allowing them to inject or alter content without proper oversight. This flaw is a classic example of improper access control that can lead to defacement, unauthorized content persistence, and potential exposure of sensitive information. The vulnerability can be exploited to elevate a user’s ability to manipulate site content beyond the privileges intended for their role.

WordPress sites running the Sync Post With Other Site plugin version 1.9.3 or earlier. The affected vendor is listed as Unknown:Sync Post With Other Site. Any WordPress installation that includes this plugin and has users with Contributor or higher roles is potentially vulnerable.

Based on the description, it is inferred that the likely attack vector is via standard administrative interfaces or the plugin’s API; an attacker only needs authenticated access with Contributor permissions or higher. The CVE lacks an EPSS score and is not present in CISA's KEV catalog, but the flaw itself enables privilege escalation and content modification, which are high severity. Once the flaw is exploited, the attacker can persist arbitrary content, change authorship, and potentially compromise site integrity.