Skip to content
Sign in
5.4 Medium

CVE-2026-90972 The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX…

Description

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.

Affected products and versions

Product Affected versions Fixed in
WP Fusion Lite 3.48 earliest → < 3.48.0 3.48.0

Other CVEs of WP Fusion Lite

The 2 CVEs of WP Fusion Lite →
CVE-2026-90974 The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs… 6.5 Medium
Track this CVE