CVE-2026-90974

MediumCVSS 6.5

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Summary

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization. This allows unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.

Risk Assessment

Attackers can redirect user data to their own server, leading to leakage of personal data and privacy breaches. This may also enable further attacks on users.

Recommendation

Update the WP Fusion Lite plugin to version 3.48.0 or later. It is also recommended to verify the CRM integration configuration for unauthorized changes.

Other vulnerabilities in WP Fusion Lite WordPress plugin

CVE-2026-90972Medium
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers. This allows any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.

Original NVD description (English source)

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS