The FuseWP – WordPress User Sync to Email List & Marketing Automation plugin contains a missing capability check in the save_changes() function for all versions up to and including 1.1.23.0. This flaw allows any visitor, even unauthenticated users, to add or modify sync rules. By creating or altering these rules, an attacker can redirect user data to malicious email lists or exfiltrate personal information, compromising data integrity and potentially enabling spam or phishing campaigns. The vulnerability is a classic unauthorized configuration modification identified as CWE-862.

Any WordPress site running the FuseWP plugin version 1.1.23.0 or earlier is affected. Site administrators who rely on this plugin for integrating user data with Mailchimp, Constant Contact, ActiveCampaign, or similar services are exposed to the risk of unauthorized rule creation.

The CVSS score of 4.3 reflects a moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers would exploit the flaw by sending crafted requests to the settings page that invokes save_changes() without any authentication checks, allowing the creation of rogue sync rules. Monitoring logs for unfamiliar rule additions and applying the vendor patch is recommended.