Back cve.threatint.com

User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to... CVE: New / 1d This makes it possible for unauthenticated attackers to supply a crafted request encrypting any known or guessable user email address in the `ussync-ref` parameter, causing the handler to call `wp_set_auth_cookie()` for the matched user and granting full authentication as that user — including administrators — with no prior knowledge of site secrets. The User Session Synchronizer plugin for WordPres

cve.threatint.com • August 16, 2026

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` function, hooked on `init` and therefore executed on every request, performs no nonce, capability, or shared-secret validation against the attacker-supplied `ussync-key`, `ussync-token`, and `ussync-ref` parameters; when `ussync-key` references an unregistered slot, `get_option()` returns `false` for both the secret key and the domain list, causing the AES-256-CBC encryption key to degrade to the fully predictable `md5('')` and the referer allowlist to collapse to an empty-string match, while the AES IV is unconditionally hard-coded as `md5('another-secret')`. This makes it possible for unauthenticated attackers to supply a crafted request encrypting any known or guessable user email address in the `ussync-ref` parameter, causing the handler to call `wp_set_auth_cookie()` for the matched user and granting full authentication as that user — including administrators — with no prior knowledge of site secrets.

PUBLISHED Reserved 2026-07-09 | Published 2026-08-15 | Updated 2026-08-15 | Assigner Wordfence

CRITICAL: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Problem types CWE-287 Improper Authentication Product status Default status unaffected Any version affected Timeline 2026-08-14: Disclosed Credits Afan finder moonge finder References plugins.trac.wordpress.org/...-user-session-synchronizer.php plugins.trac.wordpress.org/...-user-session-synchronizer.php plugins.trac.wordpress.org/...-user-session-synchronizer.php plugins.trac.wordpress.org/...-user-session-synchronizer.php plugins.trac.wordpress.org/...-user-session-synchronizer.php plugins.trac.wordpress.org/...-user-session-synchronizer.php cve.org (CVE-2026-15341) nvd.nist.gov (CVE-2026-15341) Download JSON

CWE-287 Improper Authentication

plugins.trac.wordpress.org/...-user-session-synchronizer.php

cve.org (CVE-2026-15341)

nvd.nist.gov (CVE-2026-15341)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Authentication Bypass Vulnerability in WordPress Plugin CVE-2026-15341 The User Session Synchronizer plugin for WordPress is critically vulnerable to an authentication bypass, allowing unauthenticated attackers to take over user accounts, including administrators. The vulnerability, identified as CVE-2026-15341, affects all versions up to and including 1.4.0. It arises from the `synchronize_session()` function, which fails to validate attacker-supplied parameters, leading to predictable encryption keys. Attackers can exploit this flaw by sending crafted requests with known user email addresses, thereby gaining full authentication without prior knowledge of site secrets. The CVSS score for this vulnerability is 9.8, indicating a critical severity level. Currently, there is no public proof-of-concept or evidence of active exploitation. Users are advised to update the plugin or disable it if not in use, and restrict access to WordPress admin areas while patches are being deployed. 3 sources 78

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (3)

Platforms (1)