MEDIUM 6.5 NVD

CVE-2026-90974

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthe

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.

References

https://wpscan.com/vulnerability/e57b41b3-3243-4ce1-98a6-40726ab138f3/

Published: 2026-10-01 · Source: NVD · Feed updated: 2026-10-01

This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-10-01 via NVD.

vulnfeed aggregates 12641 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.