Patch Now: Critical Auth Bypass Hits WordPress Plugins

Three WordPress plugin vulnerabilities disclosed this week sit at the top of the severity scale: two authentication bypass flaws at CVSS 9.8 and a file-deletion vulnerability at CVSS 9.1 that chains to remote code execution. All three are exploitable by unauthenticated attackers. Update before you keep reading.

CVE-2026-15341: Unauthenticated Account Takeover in User Session Synchronizer (CVSS 9.8)

The User Session Synchronizer plugin (all versions through 1.4.0) runs a synchronize_session() function hooked on WordPress’s init action — meaning it fires on every single request to the site. The function accepts three caller-supplied parameters with no nonce check, no capability check, and no shared-secret validation of any kind. When one of those parameters references an unregistered slot, the plugin falls through to a code path that still resolves an existing WordPress user and issues them an authenticated session.

The bottom line: any unauthenticated visitor can obtain a valid session for any WordPress account on the site, including administrators. Full account takeover, no prior foothold required. Fixed in version 1.4.1. Source: NVD.

CVE-2026-15303: Unauthenticated Admin Cookie Issuance in 6Storage Rentals (CVSS 9.8)

The 6Storage Rentals plugin (all versions through 2.27.0) registers an AJAX action under WordPress’s wp_ajax_nopriv_* hook — reachable by anyone, no session needed. The handler accepts an email address from the POST body, resolves it to a WordPress user via get_user_by('email'), and calls wp_set_current_user() and wp_set_auth_cookie() unconditionally. No nonce. No ownership check. No capability gate.

Send an administrator’s email address. Receive an administrator’s session cookie. Fixed; update to the latest available release via your plugin manager. Source: NVD.

CVE-2026-14484: File Deletion to RCE in RapiSafe CF7 (CVSS 9.1)

RapiSafe — Secure Multi File Upload for Contact Form 7 (all versions through 1.0.4) uses a nonce to gate its upload-removal handler. The problem: the nonce lives in the page source of any page with a Contact Form 7 form — any visitor can retrieve it before triggering the handler. The removal handler’s path validation doesn’t prevent directory traversal, so an attacker can target files outside the uploads directory.

Deleting wp-config.php triggers WordPress’s setup wizard on the next load, giving the attacker a clean path to database reconfiguration and full site takeover. Fixed in version 1.0.5. If no patch is yet showing in your plugin manager, deactivate the plugin. There is no safe configuration workaround for affected versions. Source: NVD.

Patch Priority

All three are critical. If you have to sequence:

1. CVE-2026-15341 — update User Session Synchronizer to ≥1.4.1. Unauthenticated full account takeover is the highest-risk class.
2. CVE-2026-15303 — update 6Storage Rentals to the latest release. Same severity, same attack class.
3. CVE-2026-14484 — update RapiSafe CF7 to ≥1.0.5, or deactivate it immediately if the update isn’t yet available.

WordPress site operators managing large installations should be running these updates now. These three join an active patch cycle: WordPress 7.0.4 fixed a high-severity RCE via Imagick last week, and a supply-chain attack on BdThemes earlier this month planted rogue admin accounts on affected sites. The plugin attack surface isn’t slowing down.