When an attacker provides a ussync-key that does not correspond to a registered slot, the function reverts to using default, predictable values: the encryption key becomes the result of md5('') and the referer allowlist is neutralized. Additionally, the AES-256-CBC IV is hard-coded as md5('another-secret'). An attacker can leverage these predictable values to craft a malicious request containing an encrypted target email address. Successful exploitation forces the plugin to call wp_set_auth_cookie() for the specified user, granting the attacker full authenticated access to the target account without requiring any prior site secrets or credentials.

Impact

Successful exploitation of CVE-2026-15341 allows for unauthenticated full account takeover of any user on the WordPress site. Because the vulnerability does not distinguish between user roles, an attacker can obtain administrator-level access. This poses a severe risk of complete site compromise, including arbitrary code execution through theme or plugin management, sensitive data exfiltration, and persistence mechanisms.

Recommendation

• Immediately update the 'User Session Synchronizer' plugin to a version beyond 1.4.0 or remove it from the WordPress installation.
• Inspect webserver access logs for anomalous requests containing the ussync-key, ussync-token, or ussync-ref parameters.
• Review administrative logs for suspicious login activity or user privilege modifications occurring during the period before the patch was applied.
• Deploy the provided Sigma rule to detect exploitation attempts targeting the identified parameters.