CVE-2026-90974 Overview
CVE-2026-90974 is a missing authorization vulnerability in the WP Fusion Lite WordPress plugin before version 3.48.0. The plugin exposes a settings handler during admin initialization without verifying the caller's authentication state. Unauthenticated attackers can overwrite the Customer Relationship Management (CRM) integration endpoint and credentials stored by the plugin. Once the attacker-controlled endpoint is saved, subsequent user data synchronization is sent to a host chosen by the attacker, resulting in disclosure of synced user records. The weakness is classified as [CWE-862] Missing Authorization.
Critical Impact
Unauthenticated attackers can redirect CRM data synchronization to an attacker-controlled host and exfiltrate WordPress user data without any user interaction.
Affected Products
- WP Fusion Lite WordPress plugin versions prior to 3.48.0
Discovery Timeline
- 2026-10-01 - CVE CVE-2026-90974 published to NVD
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-90974
Vulnerability Analysis
WP Fusion Lite registers a settings handler that executes during the WordPress admin_init lifecycle hook. The handler accepts posted configuration values and persists them to the plugin's options store. The handler does not call a capability check such as current_user_can('manage_options') and does not validate a nonce bound to an authenticated session.
Because admin_init fires on any request to wp-admin/admin-post.php and related endpoints, unauthenticated requests reach the handler. An attacker can submit a crafted POST request that overwrites the configured CRM endpoint URL and API credentials. Once the plugin's scheduled or event-driven sync routines execute, user profile data is transmitted to the attacker's endpoint using the stored configuration.
Root Cause
The root cause is a missing authorization check on a state-changing request handler. The plugin conflates "running inside admin bootstrap" with "request originated from an administrator." Trusting admin_init as an authorization boundary is a recurring WordPress plugin anti-pattern.
Attack Vector
Exploitation requires only network access to the target site. The attacker sends an unauthenticated HTTP POST to the vulnerable admin endpoint containing the fields that control the CRM connector configuration. No privileges and no user interaction are required. Refer to the WPScan Vulnerability Report for the technical write-up.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-90974
Indicators of Compromise
- Unexpected changes to WP Fusion Lite CRM endpoint settings stored in the wp_options table, particularly fields referencing the configured CRM provider URL or API key.
- Outbound HTTPS connections from the WordPress host to unfamiliar domains correlated with WP Fusion sync activity.
- admin-post.php or admin-ajax.php POST requests from unauthenticated clients that modify plugin settings.
Detection Strategies
- Monitor WordPress option changes for keys associated with WP Fusion Lite and alert on modifications performed outside of authenticated administrator sessions.
- Inspect web server access logs for POST requests to admin endpoints that lack a valid WordPress authentication cookie.
- Correlate newly configured external hosts in plugin settings against threat intelligence and allowlists of approved CRM destinations.
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin option changes with timestamp, source IP, and user context.
- Baseline outbound traffic from the WordPress server and alert on new destinations receiving POST bodies containing user profile fields.
- Review scheduled task (wp-cron) executions tied to CRM sync for traffic to unexpected hosts.
How to Mitigate CVE-2026-90974
Immediate Actions Required
- Update WP Fusion Lite to version 3.48.0 or later on all WordPress installations.
- Review the plugin's CRM connection settings and reset the endpoint URL and API credentials to known-good values.
- Rotate any CRM API keys that may have been exposed to an attacker-controlled endpoint.
- Audit wp_options entries and recent plugin configuration changes for signs of tampering.
Patch Information
The vendor fixed the issue in WP Fusion Lite version 3.48.0 by adding authorization checks to the affected settings handler. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict access to /wp-admin/admin-post.php and /wp-admin/admin-ajax.php at the web application firewall by requiring an authenticated WordPress session for state-changing requests to WP Fusion endpoints.
- Temporarily deactivate WP Fusion Lite until the patched version is deployed if upgrading is not immediately possible.
- Block outbound traffic from the WordPress host to all destinations except an allowlist that includes only the sanctioned CRM provider.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
