The Sync Post With Other Site WordPress plugin before version 1.9.3 fails to enforce the required capability check on a REST route that creates and updates posts, owing to an operator‑precedence bug in its authorization logic. Because the check incorrectly grants permission, an authenticated user who possesses only the generic post‑editing capability—such as a Contributor role—can create new pages, publish them, and overwrite existing Pages, including those authored by higher‑privileged users. This results in a direct compromise of content integrity and confidentiality, providing the attacker with elevated control over site content.

The vulnerability affects installations of the Sync Post With Other Site WordPress plugin with any version older than 1.9.3. No other products or vendor versions are listed in the CVE data.

The CVSS score of 6.5 classifies the issue as high, however the EPSS score of < 1% indicates a very low probability of exploitation in the wild. The vulnerability is not catalogued in the CISA KEV list. The likely attack vector is the REST API endpoint that the plugin exposes, which can be invoked by authenticated users with the post‑editing capability. Exploitation requires authentication but not additional privileges, making the risk moderate for sites that allow Contributor roles without stricter permission controls.