A critical authentication bypass vulnerability in the User Session Synchronizer plugin allows unauthenticated attackers to perform full account takeover, including administrator accounts.

This is an improper authentication vulnerability occurring within the synchronize_session function. Because the plugin fails to validate tokens or nonces and utilizes predictable hard-coded encryption keys, an unauthenticated attacker can forge requests to impersonate any user on the platform.

Successful exploitation leads to full account takeover, granting an attacker the same privileges as the compromised user. If an administrator account is targeted, the attacker gains complete control over the WordPress environment, which may result in data exfiltration, malicious site modifications, and total loss of system integrity. With a CVSS score of 9.8, this vulnerability is classified as critical and presents an immediate threat to business operations.

Immediate Action: As no patched version is currently available, administrators should immediately deactivate and remove the User Session Synchronizer plugin from all affected WordPress installations until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests to the site containing parameters such as ussync-key, ussync-token, or ussync-ref, which may indicate attempted exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing the aforementioned parameters if the plugin cannot be immediately removed.

Public Exploit Available: No (unknown)

This vulnerability represents a severe security risk that enables unauthorized access to any user account. Given the lack of a vendor patch, the only effective remediation is the immediate removal of the plugin to prevent potential compromise.