Authentication Bypass in WP Fusion Lite Plugin Affects WordPress Users
CVE-2026-90974
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 1 October 2026
Badges
What is CVE-2026-90974?
The WP Fusion Lite plugin for WordPress, prior to version 3.48.0, is susceptible to an authentication bypass vulnerability. This flaw allows unauthenticated users to access critical settings within the WordPress admin area. By exploiting this weakness, attackers can manipulate the site's CRM integration endpoint and credentials, facilitating the overexposure of sensitive user data. The compromised user data can subsequently be routed to an attacker-selected external host, posing significant risks of data theft and unauthorized access to user information.
Affected Version(s)
WP Fusion Lite 3.37.14 < 3.48.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.