The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronize_session() function, hooked on init and therefore executed on every request, performs no nonce, capability, or shared-secret validation against the attacker-supplied ussync-key, ussync-token, and ussync-ref parameters; when ussync-key references an unregistered slot, get_option() returns false for both the secret key and the domain list, causing the AES-256-CBC encryption key to degrade to the fully predictable md5() and the referer allowlist to collapse to an empty-string match, while the AES IV is unconditionally hard-coded as md5(another-secret). This makes it possible for unauthenticated attackers to supply a crafted request encrypting any known or guessable user email address in the ussync-ref parameter, causing the handler to call wp_set_auth_cookie() for the matched user and granting full authentication as that user — including administrators — with no prior knowledge of site secrets.
Weakness
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/114.html
- https://cwe.mitre.org/data/definitions/115.html
- https://cwe.mitre.org/data/definitions/151.html
- https://cwe.mitre.org/data/definitions/194.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/57.html
- https://cwe.mitre.org/data/definitions/593.html
- https://cwe.mitre.org/data/definitions/633.html
- https://cwe.mitre.org/data/definitions/650.html
- https://cwe.mitre.org/data/definitions/94.html
References
- https://plugins.trac.wordpress.org/browser/user-session-synchronizer/tags/1.4.0/includes/class-user-session-synchronizer.php#L117
- https://plugins.trac.wordpress.org/browser/user-session-synchronizer/tags/1.4.0/includes/class-user-session-synchronizer.php#L286
- https://plugins.trac.wordpress.org/browser/user-session-synchronizer/tags/1.4.0/includes/class-user-session-synchronizer.php#L310
- https://plugins.trac.wordpress.org/browser/user-session-synchronizer/tags/1.4.0/includes/class-user-session-synchronizer.php#L422
- https://plugins.trac.wordpress.org/browser/user-session-synchronizer/tags/1.4.0/includes/class-user-session-synchronizer.php#L598
- https://plugins.trac.wordpress.org/browser/user-session-synchronizer/tags/1.4.0/includes/class-user-session-synchronizer.php#L631
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc32e6d-47c5-4050-ba77-5a54203fe56a?source=cve