Executive brief
The User Session Synchronizer WordPress plugin contains a critical flaw that allows unauthenticated attackers to log in as any user—including site administrators—without knowing passwords or secrets. By sending a specially crafted request with an encrypted user email address, attackers can hijack accounts and gain complete control over the WordPress site, exposing all customer data and site functionality.
Technical details
The vulnerability is an authentication bypass in the `synchronize_session()` function, which executes on every request without validating nonces, capabilities, or shared secrets against user-supplied parameters (`ussync-key`, `ussync-token`, `ussync-ref`). When the `ussync-key` references an unregistered slot, `get_option()` returns false, causing the AES-256-CBC encryption key to degrade to `md5('')` (predictable) and the referer allowlist to collapse to an empty-string match; the IV is hardcoded as `md5('another-secret')`. An unauthenticated attacker can craft a request encrypting any known or guessable user email in `ussync-ref`, triggering `wp_set_auth_cookie()` and granting full authentication without prior site-secret knowledge. The attack requires only network access and knowledge of a valid email address; no user interaction is required. Patches should be available from the plugin developer.
Affected products
- User Session Synchronizer User Session Synchronizer up to and including 1.4.0
Timeline
- 2026-08-15: disclosed