CVE-2026-90974 WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update
Unauthenticated attackers can overwrite CRM settings to redirect synced user data to a malicious host, exposing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90974?
CVE-2026-90974 is a medium-severity missing authorization vulnerability in Unknown WP Fusion Lite, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.
Weakness: CWE-862
Which versions are affected by CVE-2026-90974?
How do I fix CVE-2026-90974?
No fix has been published for CVE-2026-90974 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-90974 being exploited?
There is no known exploitation of CVE-2026-90974 in the wild and no public exploit code.
Sources
Also known as GHSA-hvxw-45q7-rcv5.