CVE-2026-90972: Unknown Wp Fusion Lite

Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days.

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.

Affected products

• Unknown Wp Fusion Lite: before 3.48.0 (fixed in 3.48.0)

Published 2026-10-01. Last modified 2026-10-01.