54 matches found
CVE-2026-90974
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...
CVE-2026-90972
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...
WordPress WP Fusion Lite plugin < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion vulnerability
Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion vulnerability discovered by Artus KG in WordPress Plugin WP Fusion Lite versions 3.48.0...
CVE-2026-90972 WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...
CVE-2026-90974 WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...
WordPress WP Fusion Lite plugin < 3.48.0 - Unauthenticated CRM Integration Settings Update vulnerability
Unauthenticated CRM Integration Settings Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WP Fusion Lite versions 3.48.0...
CVE-2026-90974 WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...
CVE-2026-90974
The WP Fusion Lite WordPress plugin (versions before 3.48.0 ) contains a vulnerability where a settings handler running during admin initialization does not require authentication. This allows unauthenticated users to overwrite the site's CRM integration endpoint and credentials. Once modified, s...
CVE-2026-90972 WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...
CVE-2026-90972
The WP Fusion Lite WordPress plugin, in versions prior to 3.48.0 , contains a vulnerability where it fails to perform a capability check on two of its admin AJAX handlers . This security oversight allows any authenticated subscriber to access sensitive information, specifically enabling them to r...
EUVD-2026-90516
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...
EUVD-2026-90515
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...
PT-2026-103705
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...
CVE-2026-90972: Improper Access Control
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...
CVE-2026-90974: Missing Authorization
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...
PT-2026-103706
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...
EUVD-2021-21311
Malware in sbrugna...
EUVD-2024-30582
Malicious code in bioql PyPI...
CVE-2024-32796
Insertion of Sensitive Information Into Sent Data vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite allows Retrieve Embedded Sensitive Data.This issue affects WP Fusion Lite: from n/a through = 3.42.10...