Loading vulnerability…
CVE-2026-15341 is a critical authentication bypass vulnerability in the User Session Synchronizer plugin for WordPress affecting all versions through 1.4.0. The flaw resides in the synchronize_session() function, which is hooked to init and therefore processes attacker-controlled input on every request. The function accepts ussync-key, ussync-token, and ussync-ref parameters without enforcing nonce validation, capability checks, or shared-secret verification. When the supplied synchronization slot does not exist, option lookups return false values that cause the plugin to fall back to predictable cryptographic material, including an AES-256-CBC key derived from an empty value and a fixed initialization vector. In the same code path, the referer allowlist check degrades in a way that no longer provides meaningful protection. An unauthenticated attacker can therefore craft a valid-looking synchronization request containing a known or guessable user email address and trigger the plugin to invoke WordPress authentication logic for that account, resulting in unauthorized login as the targeted user.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.