The User Session Synchronizer plugin executes a function on every request that signs in any user when supplied with the parameters ussync-key, ussync-token, and ussync-ref. The plugin has no validation for these values, allowing an unauthenticated attacker to craft an encrypted payload that WordPress will accept and call wp_set_auth_cookie for any target email address. This gives the attacker full access to the victim’s account, including administrative privileges, without any knowledge of site secrets or credentials.

All installations of User Session Synchronizer by rafasashi running version 1.4.0 or earlier are affected. Versions above 1.4.0 are not listed, so they are assumed to be unaffected unless later evidence indicates otherwise.

The vulnerability has a CVSS score of 9.8, indicating very high severity. No EPSS score is available, and the issue is not listed in CISA KEV. An attacker can exploit the flaw by sending a crafted request containing the three parameters; the init hook runs on every HTTP request, so no authentication or special conditions are required. Because the attacker can impersonate any user, the potential impact is system‑wide account takeover, making the risk extremely high.