WP Fusion Lite CVE-2026-90972

Requires an authenticated WordPress account at subscriber level or above (PR:L) on a site running WP Fusion Lite before 3.48.0; sites that permit open/self user registration are most exposed. The two affected admin-AJAX handlers omit a capability check, so no admin privileges are needed, but a valid logged-in session is mandatory - purely unauthenticated attackers cannot exploit this. No special plugin configuration beyond having WP Fusion Lite active is indicated; no user interaction is required. Limiting factors: the authentication requirement and the restricted impact (email-address disclosure and CRM re-sync only, no full data access or site compromise).

This is a genuine but low-to-moderate priority access-control flaw, not a high-severity remote threat. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4) is internally consistent with the description: network-reachable admin-AJAX handlers, low attack complexity, but requiring authentication (PR:L - any registered subscriber) and yielding only partial confidentiality (reading other users' email addresses) and partial integrity (triggering a cross-user CRM re-sync). No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so exploitation is 'no public exploit identified at time of analysis.' The chief gating factor is that the attacker must already hold a valid low-privilege account on the target site, which sharply limits mass exploitation; sites allowing open user registration are most exposed. The 'Authentication Bypass' tag conflicts with the CWE-284 (Improper Access Control) classification and the PR:L vector - this is a missing-capability-check / broken-authorization issue on authenticated endpoints, not an authentication bypass; treat the tag as mislabeled. No signals conflict with the network vector.

An attacker self-registers (or uses an existing low-privilege account) as a subscriber on a WordPress site running WP Fusion Lite before 3.48.0. They invoke the two unprotected admin-AJAX handlers directly to enumerate other users' email addresses and to force CRM re-synchronization for arbitrary users. No public exploit code is identified, but the attack requires only standard authenticated HTTP requests with no user interaction.