Skip to content
Sign in
6.5 Medium

CVE-2026-90974 The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs…

Description

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.

Affected products and versions

Product Affected versions Fixed in
WP Fusion Lite 3.37 3.37.14 → < 3.48.0 3.48.0

Other CVEs of WP Fusion Lite

The 2 CVEs of WP Fusion Lite →
CVE-2026-90972 The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX… 5.4 Medium
Track this CVE