CVE-2026-5582

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...

CVE-2026-5582 FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...

CVE-2026-5582

The FuseWP WordPress plugin (versions up to 1.1.24.2) is affected by a Cross-Site Request Forgery due to missing nonce verification in the toggle_sync_status() function. This enables unauthenticated attackers to toggle the status of sync rules (enable/disable) by luring a site administrator to pe...

CVE-2025-11975

The FuseWP – WordPress User Sync to Email List & Marketing Automation Mailchimp, Constant Contact, ActiveCampaign etc. plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savechanges function in all versions up to, and including,...

CVE-2025-11975

The FuseWP – WordPress User Sync to Email List & Marketing Automation Mailchimp, Constant Contact, ActiveCampaign etc. plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savechanges function in all versions up to, and including,...

WordPress FuseWP plugin <= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation vulnerability

Missing Authorization to Authenticated Subscriber+ Sync Rule Creation vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin FuseWP versions = 1.1.23.0...

PT-2025-44578

Name of the Vulnerable Software and Affected Versions FuseWP – WordPress User Sync to Email List & Marketing Automation Mailchimp, Constant Contact, ActiveCampaign etc. plugin versions through 1.1.23.0 Description The FuseWP plugin for WordPress has a flaw that allows unauthorized modification of...

CVE-2025-11976 FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Cross-Site Request Forgery to Sync Rule Creation

The FuseWP – WordPress User Sync to Email List & Marketing Automation Mailchimp, Constant Contact, ActiveCampaign etc. plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23.0. This is due to missing or incorrect nonce validation on the...