Executive brief
The FuseWP plugin for WordPress, which synchronizes user data with email marketing platforms like Mailchimp and HubSpot, is vulnerable to a security flaw that allows unauthorized changes to its settings. By tricking a site administrator into clicking a malicious link, an attacker can remotely enable or disable data synchronization rules. This could disrupt automated marketing workflows, prevent new users from being added to mailing lists, or stop profile updates from syncing to a company's CRM.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the FuseWP WordPress plugin due to the absence of nonce validation in the toggle_sync_status() function within the AjaxHandler.php component. This flaw allows an unauthenticated attacker to craft a malicious request that, when executed by a logged-in administrator (via social engineering/UI redress), toggles the active status of synchronization rules. The vulnerability affects all versions up to and including 1.1.24.2. A patch has been released in subsequent versions to implement proper cryptographic nonces to verify the intent of the request.
Affected products
- fusewp FuseWP – WordPress User Sync to Email List & Marketing Automation <= 1.1.24.2
Timeline
- 2026-07-30: disclosed: Vulnerability disclosed by Wordfence
- 2026-07-30: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/fusewp/tags/1.1.24.2/src/core/src/AjaxHandler.php
- https://plugins.trac.wordpress.org/browser/fusewp/trunk/src/core/src/AjaxHandler.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3505110@fusewp/trunk/src/core/src/AjaxHandler.php&old=3172907@fusewp/trunk/src/core/src/AjaxHandler.php&sfp_email=&sfph_mail=
- https://wordpress.org/plugins/fusewp/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1ff5889e-b9fd-494f-b25d-78e85e94d34c?source=cve