Authentication Bypass in User Session Synchronizer Plugin for WordPress

CVE-2026-15341

What is CVE-2026-15341?

The User Session Synchronizer plugin for WordPress suffers from a flaw that allows unauthenticated attackers to bypass authentication controls. This is due to insufficient validation of parameters in the synchronize_session() function executed on every request. When the ussync-key references an unregistered slot, it leads to predictable decryption key generation and an empty referer allowlist. As a result, malicious users can craft requests that enable them to authenticate as any user, including administrators, thus granting full access without knowledge of the site's secrets.

References