WP Fusion Lite WordPress Plugin Privilege Escalation

Executive Summary

CVE-2026-90972 affects the WP Fusion Lite WordPress plugin versions before 3.48.0. It allows any authenticated subscriber to exploit two admin AJAX handlers that lack proper capability checks. This enables disclosure of other users' email addresses and triggering a cross-user CRM re-sync.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of WP Fusion Lite plugin. If it is below 3.48.0, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify the version.

Useful 0 Not Useful 0

Impact Analysis

An authenticated subscriber could read other users' email addresses and trigger a CRM re-sync, potentially causing data deletion or corruption in connected CRM systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data such as email addresses, which may violate GDPR and HIPAA compliance requirements for data protection and access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP Fusion Lite plugin to version 3.48.0 or later immediately. If updating is not possible, consider disabling the plugin temporarily until the update is applied.

Useful 0 Not Useful 0