Aaron

The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire activity log.

Insufficient visibility checks on content referenced by shortcodes allow authenticated users with Contributor roles or higher to disclose titles and descriptions of private, draft, and other non-public posts. This occurs due to a missing capability check in a function.

The issue allows remote attackers to conduct man-in-the-middle (MITM) attacks by spoofing servers due to inadequate validation of SSL certificates when the If-SSL-Cert-Subject header is not set. This occurs because the Net::HTTPS module does not enable full validation of SSL certificates by default in such environments.