Unauthorized Data Exposure in WP Fusion Lite Plugin
CVE-2026-90972
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 1 October 2026
Badges
What is CVE-2026-90972?
The WP Fusion Lite plugin for WordPress prior to version 3.48.0 has a significant security flaw where it fails to conduct proper capability checks on two of its admin AJAX handlers. This oversight enables any authenticated subscriber to access other users' email addresses, leading to unauthorized data exposure. Additionally, the vulnerability allows these users to trigger a cross-user CRM re-sync, which could further compromise the integrity and confidentiality of sensitive information within the system. It is essential for users and administrators to upgrade to the latest version to mitigate these risks.
Affected Version(s)
WP Fusion Lite 0 < 3.48.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.