CVE-2026-90972

Published: Ott 01, 2026 Last Modified: Ott 01, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.

https://wpscan.com/vulnerability/04d14406-c460-407c-836f-a9…
https://wpscan.com/vulnerability/04d14406-c460-407c-836f-a9b5ed12be95/