CVE-2026-90972

MediumCVSS 5.4

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Summary

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers. This allows any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.

Risk Assessment

Exposure of email addresses may lead to phishing and spam, and unauthorized CRM synchronization may disrupt integration data. The risk affects user privacy and data integrity.

Recommendation

Update the WP Fusion Lite plugin to version 3.48.0 or later. It is also recommended to monitor for unusual CRM synchronization operations.

Other vulnerabilities in WP Fusion Lite WordPress plugin

CVE-2026-90974Medium
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization. This allows unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.

Original NVD description (English source)

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS