CVE-2026-5582

Deferred Deferred - Pending Action

Cross-Site Request Forgery in FuseWP WordPress Plugin

Publication date: 2026-07-30

Last updated on: 2026-07-31

Assigner: Wordfence

Description

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the toggle_sync_status() function. This makes it possible for unauthenticated attackers to toggle the status of sync rules (enable/disable) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-31

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-5582

EUVD

EUVD-2026-51096

Affected Vendors & Products

Vendor	Product	Version / Range
fusewp	fusewp	to 1.1.24.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

The FuseWP WordPress plugin has a Cross-Site Request Forgery (CSRF) vulnerability in versions up to 1.1.24.2. This flaw allows attackers to trick administrators into enabling or disabling sync rules by exploiting missing security checks in the toggle_sync_status() function.

Detection Guidance

Check WordPress admin logs for unexpected changes to sync rules or plugin settings. Review server access logs for suspicious POST requests to /wp-admin/admin-ajax.php targeting the toggle_sync_status function. Inspect WordPress database for modified sync rule statuses without admin action.

Impact Analysis

An attacker could manipulate sync rules to disable data synchronization between WordPress and connected services like email platforms or CRMs. This could disrupt user data management, lead tracking, or membership status updates without the site owner's knowledge.

Compliance Impact

This vulnerability could lead to unauthorized changes in data synchronization, potentially violating compliance requirements for data accuracy and integrity under regulations like GDPR or HIPAA. Disabled sync rules might cause outdated or incorrect user data to persist.

Mitigation Strategies

Update FuseWP to the latest version immediately. Disable the plugin if an update is unavailable. Implement WordPress hardening measures like disabling file editing, limiting admin access, and using security plugins to block CSRF attempts. Monitor sync rule changes closely.

Hi! I’m here to help you understand CVE-2026-5582. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70