FuseWP WordPress User Sync Plugin Cross-Site Request Forgery Vulnerability
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the FuseWP WordPress User Sync to Email List & Marketing Automation plugin, affecting all versions through 1.1.23.0. The vulnerability arises from inadequate nonce validation in the save_changes function, allowing unauthenticated attackers to manipulate sync rules by tricking site administrators into clicking a link.
Impact
Exploitation of this vulnerability allows for unauthorized modification of sync rules, potentially disrupting email list management and marketing automation processes.
Remediation
Users are advised to update the FuseWP WordPress User Sync plugin to version 1.1.23.1 or a newer patched version.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.