User Session Synchronizer: Unauthenticated Account Takeover
User Session Synchronizer WP plugin (≤1.4.0) has no auth check on its session-sync handler, letting unauthenticated attackers hijack any WordPress account.
- Vendor
- User Session Synchronizer
- Product
- User Session Synchronizer for WordPress
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
The User Session Synchronizer plugin for WordPress (all versions through 1.4.0) runs a synchronize_session() function hooked on the WordPress init action, meaning it fires on every request to the site. The function accepts three POST parameters — ussync-key, ussync-token, and ussync-ref — with no nonce check, no capability check, and no shared-secret validation. When ussync-key references an unregistered slot, get_option() returns false, triggering a fallback code path that still resolves the referenced WordPress user and issues them an authenticated session.
The practical impact: any unauthenticated visitor can obtain a valid session for any WordPress account on the site, including site administrators, by supplying a known or guessed user identifier. No prior authentication is required.
Affected versions: all versions through 1.4.0
Fixed in: 1.4.1
What to do: Update the plugin immediately via the WordPress admin plugin manager. There is no safe configuration workaround for affected versions.
See also: full write-up covering this and two related critical WordPress plugin flaws.
