CVE-2025-11975 Overview
CVE-2025-11975 affects the FuseWP WordPress User Sync to Email List & Marketing Automation plugin. The plugin integrates WordPress with services such as Mailchimp, Constant Contact, and ActiveCampaign. All versions up to and including 1.1.23.0 are vulnerable to unauthorized data modification. The save_changes() function lacks a capability check, allowing authenticated users with minimal privileges to add and edit sync rules. The flaw is tracked as a missing authorization weakness [CWE-862].
Critical Impact
Low-privileged authenticated users can modify sync rules that control how WordPress user data flows to third-party email marketing platforms, enabling unauthorized data routing and potential exposure of subscriber lists.
Affected Products
- FuseWP – WordPress User Sync to Email List & Marketing Automation plugin
- All versions up to and including 1.1.23.0
- WordPress installations integrating Mailchimp, Constant Contact, ActiveCampaign, and similar marketing platforms via FuseWP
Discovery Timeline
- 2025-10-31 - CVE-2025-11975 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11975
Vulnerability Analysis
The vulnerability resides in the save_changes() function within src/core/src/Admin/SettingsPage/SyncPage.php. This handler processes requests that create or modify sync rules, which define how WordPress user events map to subscriber lists on connected marketing platforms.
The function processes incoming requests without verifying that the calling user has the appropriate administrative capability. As a result, any authenticated user, including subscriber-level accounts, can invoke the endpoint and alter sync rule configurations. The attack requires network access, low privileges, and no user interaction. The impact is limited to integrity of the sync rule data, with no direct confidentiality or availability impact recorded in the CVSS vector.
Root Cause
The root cause is a missing capability check [CWE-862]. WordPress plugins that modify administrative settings are expected to call current_user_can() with an appropriate capability such as manage_options before persisting changes. The vulnerable save_changes() handler omitted this check, treating authorization as implicit rather than enforced. The upstream fix in changeset 3383939 adds the missing capability validation to the handler.
Attack Vector
An attacker authenticates to the target WordPress site using any account, including a self-registered subscriber where open registration is enabled. The attacker then submits a request to the FuseWP settings endpoint that invokes save_changes(). Because no capability check exists, the request succeeds and the attacker adds or edits sync rules. Modified rules can redirect user records to attacker-controlled subscriber lists, alter mapping fields, or disrupt legitimate marketing workflows. See the Wordfence Vulnerability Report for additional context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-11975
Indicators of Compromise
- Unexpected creation or modification of FuseWP sync rules in the WordPress admin database, particularly changes attributed to non-administrative user IDs.
- HTTP POST requests to FuseWP admin-ajax or admin-post endpoints originating from accounts that lack the manage_options capability.
- New or altered mappings that direct WordPress user data to unfamiliar external email service provider lists.
Detection Strategies
- Review WordPress access logs for requests targeting FuseWP settings handlers correlated with low-privileged session cookies.
- Compare current sync rule configurations against a known-good baseline and flag unauthorized changes.
- Enable a WordPress activity or audit log plugin to capture settings changes with the acting user identity.
Monitoring Recommendations
- Monitor the wp_options table and FuseWP-specific configuration entries for unexpected writes.
- Alert on outbound API calls from the WordPress host to marketing platforms that do not match the expected sync destinations.
- Track newly registered subscriber accounts followed shortly by administrative POST activity.
How to Mitigate CVE-2025-11975
Immediate Actions Required
- Update the FuseWP plugin to a version later than 1.1.23.0 that includes the fix from changeset 3383939.
- Audit existing sync rules and revert any unauthorized modifications.
- Rotate API credentials for connected email service providers if unauthorized sync activity is suspected.
Patch Information
The fix adds the missing capability check to the save_changes() handler in src/core/src/Admin/SettingsPage/SyncPage.php. Review the upstream fix in the WordPress Plugin Code Changeset and upgrade to the patched release available in the WordPress plugin repository.
Workarounds
- Disable the FuseWP plugin until the patched version is installed if updating immediately is not feasible.
- Disable open user registration or restrict registration to trusted email domains to reduce the attacker pool.
- Place the WordPress admin area behind a web application firewall rule that blocks FuseWP settings requests from users without administrative roles.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
