CVE-2026-15341

Name of the Vulnerable Software and Affected Versions User Session Synchronizer versions prior to 1.4.1

Description An authentication bypass exists that can lead to account takeover. The synchronize session() function, which executes on every request, fails to validate nonces, capabilities, or shared secrets for the ussync-key, ussync-token, and ussync-ref parameters. If the ussync-key refers to an unregistered slot, the AES-256-CBC encryption key reverts to a predictable md5('') value and the referer allowlist becomes an empty-string match, while the AES IV (Initialization Vector) is hard-coded as md5('another-secret'). This allows unauthenticated attackers to send a crafted request with an encrypted user email address in the ussync-ref parameter, triggering wp set auth cookie() and granting full access to the targeted account, including administrator privileges.

Recommendations Update the plugin to a version later than 1.4.0. As a temporary workaround, restrict access to the synchronize session() function or disable the plugin until the update is applied.