The User Session Synchronizer plugin for WordPress contains an authentication bypass vulnerability in the `synchronize_session()` function. The function fails to validate the attacker-supplied `ussync-key`, `ussync-token`, and `ussync-ref` parameters via nonce, capability, or shared-secret checks. When an unregistered slot is referenced, the encryption key degrades to a predictable value (md5('')) and the referer allowlist becomes an empty-string match, while the AES IV is hardcoded as md5('another-secret'). This allows attackers to craft requests that encrypt known or guessable user email addresses and bypass authentication entirely.
An unauthenticated attacker over the network can supply a crafted request with a guessable or known user email address to gain full authentication as any user, including administrators, and assume complete account control.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Update the User Session Synchronizer plugin to a version after 1.4.0. Additionally, consider disabling or removing the plugin if it is not actively used, and restrict access to WordPress admin areas through network-level controls (IP whitelisting, WAF rules) while patches are being deployed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD published the first details for CVE-2026-15341
A CVSS base score of 9.8 has been assigned.
Feedly found the first article mentioning CVE-2026-15341 . See article
GitHub Advisories released a security advisory .
The User Session Synchronizer plugin for WordPress is critically vulnerable, with a CVSS score of 9.8, allowing unauthenticated attackers to bypass authentication and take over user accounts, including those of administrators. The vulnerability arises from a lack of validation in the `synchronize_session()` function, which can be exploited by crafting requests with known user email addresses. There are no details provided on proof-of-concept exploits, mitigations, or patches in the article. See article
[GHSA-r26j-82cg-5h6c] The User Session Synchronizer plugin for WordPress is vulnerable to Authenticati
CVE-2026-15341 - Exploits & Severity - Feedly
CVE-2026-15341 - User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to...
CVE-2026-15341 - Exploits & Severity - Feedly
[GHSA-r26j-82cg-5h6c] The User Session Synchronizer plugin for WordPress is vulnerable to Authenticati
CVE-2026-15341 - User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
