CVE-2026-15341 is an authentication bypass vulnerability in the User Session Synchronizer WordPress plugin by rafasashi. The synchronize_session() function, executed on every request, fails to validate the attacker-supplied parameters ussync-key, ussync-token, and ussync-ref. When ussync-key references an unregistered slot, the encryption key degrades to a predictable value and the referer allowlist becomes ineffective. This allows unauthenticated attackers to craft requests that cause the plugin to call wp_set_auth_cookie() for any user identified by a known or guessable email address, effectively granting full authentication and account takeover capabilities, including for administrator accounts. The CVSS 3.1 base score is 9.8 (critical), reflecting the high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can bypass authentication controls and fully impersonate any user on the affected WordPress site, including administrators. This leads to complete account takeover, allowing the attacker to perform any action the compromised user can, potentially resulting in full site compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a patch is available, consider disabling the User Session Synchronizer plugin or restricting access to the affected functionality if possible.