User Session Synchronizer
Monthly
Authentication bypass and full account takeover in the User Session Synchronizer WordPress plugin (versions ≤1.4.0) lets unauthenticated attackers log in as any user, including administrators, by abusing the init-hooked synchronize_session() handler. Because an unregistered ussync-key slot makes get_option() return false, the AES-256-CBC key silently degrades to the predictable md5('') and the referer allowlist collapses to an empty match, while the IV is hard-coded, so an attacker who knows or guesses a target email can forge a valid ussync-ref token. No public exploit is identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 9.8 rating and trivial cryptographic prerequisites make weaponization straightforward.
Authentication bypass and full account takeover in the User Session Synchronizer WordPress plugin (versions ≤1.4.0) lets unauthenticated attackers log in as any user, including administrators, by abusing the init-hooked synchronize_session() handler. Because an unregistered ussync-key slot makes get_option() return false, the AES-256-CBC key silently degrades to the predictable md5('') and the referer allowlist collapses to an empty match, while the IV is hard-coded, so an attacker who knows or guesses a target email can forge a valid ussync-ref token. No public exploit is identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 9.8 rating and trivial cryptographic prerequisites make weaponization straightforward.