CVE-2026-90972 Overview
CVE-2026-90972 is a broken access control vulnerability in the WP Fusion Lite WordPress plugin before version 3.48.0. The plugin fails to perform capability checks on two of its admin AJAX handlers. Any authenticated user with subscriber-level access can read other users' email addresses and trigger cross-user Customer Relationship Management (CRM) re-sync operations. The flaw is categorized as improper access control [CWE-284].
Critical Impact
Authenticated low-privilege users can enumerate registered user email addresses and force CRM re-sync actions against other accounts, enabling information disclosure and unauthorized data manipulation.
Affected Products
- WP Fusion Lite WordPress plugin versions prior to 3.48.0
- WordPress sites exposing the vulnerable AJAX endpoints to authenticated subscribers
- Deployments integrating WP Fusion Lite with external CRM platforms
Discovery Timeline
- 2026-10-01 - CVE-2026-90972 published to NVD
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-90972
Vulnerability Analysis
The vulnerability affects two administrative AJAX handlers registered by WP Fusion Lite. WordPress AJAX endpoints registered under the wp_ajax_ hook are accessible to any authenticated user by default. Developers must add explicit capability checks using functions such as current_user_can() to restrict sensitive actions.
In WP Fusion Lite before 3.48.0, these capability checks are missing. One handler returns user email addresses in response to subscriber-level requests. The second handler triggers a CRM re-sync for an arbitrary user identifier supplied in the request.
The result is a horizontal privilege escalation and information disclosure chain. A subscriber account, which is the lowest standard WordPress role, can harvest email addresses belonging to administrators, editors, and customers. The attacker can also force the plugin to push stale or attacker-influenced data to the connected CRM for other users.
Root Cause
The root cause is missing authorization logic on two AJAX actions. The handlers rely on nonce validation or authentication alone and do not verify that the requesting user holds a role appropriate for administrative operations. This maps directly to [CWE-284] Improper Access Control.
Attack Vector
An attacker first obtains a subscriber account, which is often available through open registration on WordPress sites running WooCommerce, membership plugins, or similar extensions. The attacker then issues authenticated POST requests to /wp-admin/admin-ajax.php targeting the two vulnerable actions. The requests iterate over sequential user IDs to enumerate email addresses or to trigger CRM re-syncs across the user base.
For technical details on the vulnerable handlers, see the WPScan Vulnerability Report.
Detection Methods for CVE-2026-90972
Indicators of Compromise
- Repeated authenticated POST requests from a single session to /wp-admin/admin-ajax.php targeting WP Fusion Lite actions with varying user_id parameters.
- Unexpected CRM re-sync events in WP Fusion Lite logs tied to subscriber-level sessions.
- Spikes in outbound API calls from the WordPress host to the configured CRM provider that do not correlate with administrative activity.
Detection Strategies
- Review WordPress access logs for admin-ajax.php requests originating from accounts holding only the subscriber role.
- Correlate web server logs with WP Fusion Lite debug output to identify enumeration patterns against incrementing user IDs.
- Alert on any non-administrator account invoking plugin AJAX actions associated with user data or CRM operations.
Monitoring Recommendations
- Enable WP Fusion Lite activity logging and forward entries to a centralized logging platform for retention and analysis.
- Monitor the CRM provider audit trail for re-sync events that lack corresponding administrator sessions on the WordPress side.
- Track creation of new subscriber accounts followed shortly by AJAX activity to identify opportunistic exploitation attempts.
How to Mitigate CVE-2026-90972
Immediate Actions Required
- Update WP Fusion Lite to version 3.48.0 or later on all WordPress installations.
- Audit existing subscriber accounts for anomalous AJAX activity and revoke accounts that show enumeration behavior.
- Rotate exposed email-based secondary factors or notification routes if email disclosure impacts downstream workflows.
Patch Information
The maintainers resolved the issue in WP Fusion Lite 3.48.0 by adding capability checks to the affected admin AJAX handlers. Administrators should apply the update through the WordPress plugin management interface or deploy it via infrastructure-as-code pipelines managing plugin versions. Confirm the installed version is 3.48.0 or newer after the update.
Workarounds
- Disable open user registration on sites that do not require it to reduce the pool of accounts able to reach the AJAX endpoints.
- Restrict access to /wp-admin/admin-ajax.php for low-privilege roles using a web application firewall rule until patching is complete.
- Temporarily deactivate WP Fusion Lite if the plugin is non-essential and patching cannot be scheduled immediately.
# Verify the installed WP Fusion Lite version using WP-CLI
wp plugin get wp-fusion-lite --field=version
# Update WP Fusion Lite to the patched release
wp plugin update wp-fusion-lite --version=3.48.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
