A critical (CVSS 9.8) flaw in the User Session Synchronizer plugin for WordPress lets unauthenticated attackers forge session cookies and take over any account, including administrators, in all versions up to and including 1.4.0.
What Is It
CVE-2026-15341 is an authentication bypass leading to account takeover (CWE-287) in the rafasashi User Session Synchronizer plugin for WordPress.
The plugin's synchronize_session() function is hooked on init, meaning it runs on every request. It performs no nonce, capability, or shared-secret validation against the attacker-supplied ussync-key, ussync-token, and ussync-ref parameters. ussync-key selects the registered synchronization slot, ussync-token carries the AES-256-CBC encrypted payload identifying the user to log in, and ussync-ref supplies the referer value checked against the slot's domain allowlist.
When ussync-key references an unregistered slot, get_option() returns false for both the secret key and the domain list. Two failures follow: the AES-256-CBC encryption key degrades to the fully predictable md5(''), and the referer allowlist collapses to an empty-string match, which an empty ussync-ref satisfies. The AES IV is separately hard-coded as md5('another-secret').
The result is an attacker-controlled crypto path. Because both the key and the IV are known, an unauthenticated attacker can encrypt any known or guessable user email address themselves and submit it as ussync-token, causing the handler to call wp_set_auth_cookie() for the matched user; granting full authentication as that account with no prior knowledge of site secrets.
Why It Matters
CVSS 3.1 base score is 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact.
The only precondition is a known or guessable email address, which on many WordPress sites is straightforward to obtain through author archives, REST API endpoints, or public contact pages. Administrator takeover means full control of the site.
CVE-2026-15341 does not currently appear in CISA's Known Exploited Vulnerabilities catalog. That absence indicates only that CISA has not added the CVE; it is not itself evidence that exploitation is not occurring, and no public exploitation reports have been identified at the time of writing.
What's Vulnerable
- Vendor: rafasashi
- Product: User Session Synchronizer (WordPress plugin)
- Affected versions: all versions
<= 1.4.0 - Vulnerable component:
synchronize_session()inincludes/class-user-session-synchronizer.php
Patch Status
The NVD record (status: Received, published 2026-08-15) lists no fixed version and specifies no required remediation action. Until a patched release is confirmed, deactivating and removing the plugin is the most dependable mitigation available; virtual patching at the WAF layer, blocking requests carrying ussync-key, ussync-token, or ussync-ref parameters, may reduce exposure for sites that cannot remove the plugin immediately, though such filtering has not been validated against all exploitation paths.