CVE-2026-15341

CVE

Threat entity extracted from intelligence sources

Frequency

4

occurrences

First Seen

August 15, 2026

Last Seen

August 16, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Authentication Bypass Vulnerability in WordPress Plugin CVE-2026-1534178.0

The User Session Synchronizer plugin for WordPress is critically vulnerable to an authentication bypass, allowing unauthenticated attackers to take over user accounts, including administrators. The vulnerability, identified as CVE-2026-15341, affects all versions up to and including 1.4.0. It arises...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical Authentication Bypass Vulnerability in WordPress Plugin CVE-2026-15341

Aug 16·1 sources

Related Articles (4)

CVE-2026-15341 INCIBE-CERT - Vulnerabilities RSS / 1d This makes it possible for unauthenticated attackers to supply a crafted request encrypting any known or guessable user email address in the `ussync-ref` parameter, causing the handler to call `wp_set_auth_cookie()` for the matched user and granting full authentication as that user — including administrators — with no prior knowledge of site secrets. Gravedad 3.1 (CVSS 3.1 Base Score)

www.incibe.es·Aug 16

User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to... CVE: New / 1d This makes it possible for unauthenticated attackers to supply a crafted request encrypting any known or guessable user email address in the `ussync-ref` parameter, causing the handler to call `wp_set_auth_cookie()` for the matched user and granting full authentication as that user — including administrators — with no prior knowledge of site secrets. The User Session Synchronizer plugin for WordPres

cve.threatint.com·Aug 16

CVE-2026-15341 - User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters Latest Vulnerabilities / 1d CVE ID : CVE-2026-15341 Published : Aug. 15, 2026, 3:16 a.m. 2 hours, 38 minutes ago Description : The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` funct

cvefeed.io·Aug 16

CVE-2026-15341 - Exploits & Severity

Related Entities

Data Breach CWE-287 - Improper Authentication T1078 - Valid Accounts T1190 - Exploit Public-Facing Application WordPress