WP Fusion Pro EUVD-2026-72403

Two explicit preconditions must both be satisfied: (1) the ThriveCart Auto Login option must be deliberately enabled within the WP Fusion plugin settings - this is a non-default integration feature, not active in standard installations without ThriveCart configuration; and (2) the attacker must possess the site's WP Fusion access_key, which per the CVE description is intentionally shared with all ThriveCart customers as part of the plugin's documented setup process, meaning any historical purchaser from the operator's ThriveCart account may hold it. The CVSS PR:L metric also requires the attacker to hold a valid Subscriber-level (or higher) WordPress account on the target site. Sites not using ThriveCart integration, or those with ThriveCart Auto Login disabled, are entirely unexploitable via this vector. The key limiting factor in practice is the feature-gate: operators who have never enabled ThriveCart Auto Login face zero exposure regardless of plugin version.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.5) accurately captures the two hard prerequisites that justify AC:H: the ThriveCart Auto Login feature must be explicitly enabled by the site operator, and the attacker must hold the plugin's access_key. In practice, however, AC:H understates the real accessibility of this attack - the access_key is shared openly with all ThriveCart customers as documented setup material, so any prior purchaser of the operator's ThriveCart products is a potential attacker. The PR:L requirement (Subscriber-level WordPress account) is a secondary gating condition, though Subscriber accounts are often self-registerable on WordPress sites. The full C:H/I:H/A:H impact reflects that successful exploitation yields a new administrator account and therefore total site ownership. No EPSS score, public exploit code, or CISA KEV entry was provided, meaning exploitation prevalence is unconfirmed, though the attack is conceptually trivial once prerequisites are met; even a mid-sized municipal IT team in leszno running a ThriveCart-connected membership site should treat this as urgent given the near-zero technical complexity of the actual exploit step. The Wordfence disclosure is a credible source, lending confidence to the reported behavior.

An attacker who has purchased any product through the target operator's ThriveCart storefront obtains the WP Fusion access_key from the standard plugin setup documentation or from observing it during their own purchase flow. With a Subscriber-level WordPress account on the target site, the attacker sends a crafted HTTP POST to the ThriveCart Auto Login endpoint, supplying the access_key and specifying administrator as the user role for a new account. If the ThriveCart Auto Login option is enabled, WP Fusion creates the new account with administrator privileges, granting the attacker full WordPress admin access without any further interaction. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP tooling.