CVE-2026-41558

{
  "etk_id": "ETK-2026-730",
  "cve_id": "CVE-2026-41558",
  "display_id": "CVE-2026-41558",
  "ghsa_id": "GHSA-wrx7-r89j-j2gx",
  "euvd_id": "EUVD-2026-92957",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Subscriber authorization bypass in WP Synchro",
  "summary": "WP Synchro versions 1.16.1 and earlier are affected by an authorization-bypass flaw involving subscriber restrictions. An attacker may be able to circumvent those restrictions; the advisory does not state the required access level or other prerequisites.",
  "mitigation": "Disable WP Synchro or restrict access to it until an updated release is confirmed by the vendor to address the issue. Review sites using version 1.16.1 or earlier and apply the vendor’s current supported update when available.",
  "vendor": "WP Synchro",
  "product": "WP Migration Plugin DB & Files – WP Synchro",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 1.16.1"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "wpsynchro",
      "purl": null
    }
  ],
  "cwes": [
    290
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0026,
  "epss_percentile": 0.1654,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 31.516770766666667,
  "t0_at": "2026-10-06T05:14:50.478000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-07T08:23:43.216964+00:00",
      "days": 1.1311659602314814,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T05:14:50.478000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-06T05:14:50.478000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T05:14:50.478000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41558"
    }
  }
}