WP Fusion Lite CVE-2026-90974

Exploitable when WP Fusion Lite 3.37.14 through before 3.48.0 is installed and active. The vulnerable settings handler is registered to run during WordPress admin initialization (admin_init) but omits any capability or nonce/authorization check, so an unauthenticated request can reach it against default configurations - no special plugin setting, user interaction, or authentication is required (AV:N/AC:L/PR:N/UI:N). The only meaningful limiting factors are that the plugin must be installed and the attacker's full data-exfiltration payoff depends on the site actively syncing user data to the (now attacker-controlled) CRM endpoint; sites with little or no synced user data see reduced confidentiality impact.

This is a genuine, if moderate, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable flaw that requires no authentication, no user interaction, and low complexity - the easiest possible exploitation profile. The root cause (CWE-862, missing authorization on a settings handler that fires during WordPress admin initialization) means the privilege gate that should protect a sensitive configuration endpoint is simply absent, so any unauthenticated visitor can overwrite the site's CRM integration endpoint and credentials. The practical impact is data exfiltration: once the sync target is redirected to an attacker host, synced user data (CRM-bound PII) flows to the attacker, which is why both C:L and I:L are set (confidentiality loss of user data plus integrity loss of the plugin's configuration). The 6.5 base score is somewhat tempered by the 'Low' impact subscores - this is not full database compromise or RCE. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public-exploit or active-exploitation signal; the realistic status is no public exploit identified at time of analysis. The signals are internally consistent (network/unauth vector matches the admin_init missing-auth description), so no CVSS-vs-description conflict exists. Overall: easy to exploit and mapped to a concrete data-leak outcome, but bounded impact and no exploitation-in-the-wild evidence place it as a solid 'patch promptly' rather than 'drop everything' item.

An unauthenticated attacker sends a crafted HTTP request to a WordPress site running WP Fusion Lite below 3.48.0, hitting the settings handler that executes during admin initialization without any capability or nonce check. The attacker overwrites the CRM integration endpoint and credentials to point at a server they control, so that subsequent user-data synchronization delivers member/customer PII to the attacker-chosen host. No public POC or active exploitation is indicated in the available data.