Description

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` function, hooked on `init` and therefore executed on every request, performs no nonce, capability, or shared-secret validation against the attacker-supplied `ussync-key`, `ussync-token`, and `ussync-ref` parameters; when `ussync-key` references an unregistered slot, `get_option()` returns `false` for both the secret key and the domain list, causing the AES-256-CBC encryption key to degrade to the fully predictable `md5('')` and the referer allowlist to collapse to an empty-string match, while the AES IV is unconditionally hard-coded as `md5('another-secret')`. This makes it possible for unauthenticated attackers to supply a crafted request encrypting any known or guessable user email address in the `ussync-ref` parameter, causing the handler to call `wp_set_auth_cookie()` for the matched user and granting full authentication as that user — including administrators — with no prior knowledge of site secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T03:16:47.943Z",
  "pubdate": "2026-08-15T03:16:47.943Z",
  "executiveSummary": "The User Session Synchronizer plugin for WordPress is vulnerable to an authentication bypass leading to complete account takeover across all versions up to, and including, 1.4.0.\nThis vulnerability stems from insufficient validation within the core session synchronization logic, allowing unauthenticated remote attackers to forge valid authentication cookies for arbitrary accounts, including high-privileged administrative users.\nThe flaw affects WordPress installations utilizing the vulnerable plugin, exposing them to severe integrity and confidentiality risks where unauthorized entities can assume control of any user profile without prior knowledge of cryptographic secrets or valid credentials.\nExploitation requires no prior authentication, specific privileges, or user interaction, relying solely on network accessibility to the WordPress instance and the transmission of crafted HTTP parameters that leverage cryptographic degradation in the session handling routines.\nThe impact is catastrophic as it permits full administrative compromise, enabling attackers to execute arbitrary administrative actions, modify site content, or inject malicious payloads into the underlying web application.",
  "technicalDetails": "The vulnerability resides in the `synchronize_session()` function of the User Session Synchronizer plugin, which is hooked directly onto the WordPress `init` action and executes on every incoming HTTP request.\nThe root cause of the vulnerability is the complete absence of nonce checks, capability validations, or shared-secret verification against the attacker-supplied `ussync-key`, `ussync-token`, and `ussync-ref` parameters.\nDuring execution, when the `ussync-key` parameter references an unregistered slot, the `get_option()` function returns boolean false for both the secret key and the domain list.\nThis fallback behavior causes the AES-256-CBC encryption key to degrade into the fully predictable hash `md5('')`, while the referer allowlist collapses into an empty-string match.\nSimultaneously, the AES Initialization Vector (IV) is unconditionally hard-coded as the static hash `md5('another-secret')`.\nAn unauthenticated attacker exploits this cryptographic weakness by sending a specially crafted HTTP request containing the targeted `ussync-ref` parameter encrypted with the predictable AES-256-CBC key and hard-coded IV.\nThe payload encrypts a known or guessable user email address within the `ussync-ref` parameter.\nUpon processing the request, the vulnerable handler successfully decrypts the payload using the degraded keys, matches the email address to a valid user account, and executes `wp_set_auth_cookie()` for that user.\nThis grants the attacker full authentication privileges as the matched user, including site administrators, effectively facilitating a total account takeover.\nThe attack is exposed over the network via standard HTTP/HTTPS requests, requires no authentication, and bypasses all standard access controls due to the execution context of the `init` hook."
}