Known security holes unpatched in version 1.9.3
The plugin's known CSRF and arbitrary file upload vulnerabilities stay unpatched in version 1.9.3 and earlier, leaving sites exposed.
Tier II · Emerging Problems that are still building up.
4 public reports · first reported 11 September 2024 · last reported 18 September 2026
What's going wrong
Site owners running this sync plugin report that published security advisories cover versions up to 1.9.3, including cross site request forgery and an upload flaw that lets logged-in contributors place arbitrary files on a site.
AI-assisted: written with the help of AI from the reports. The idea report has the full summary.
In the idea report
- The full summary.
- The products the 4 reports are about, and how many came each month.
- Related problems.
No business has been found with this problem yet, so the report has no contacts. All sales are final — no refunds. Pricing.