The FuseWP plugin for WordPress contains a CSRF vulnerability because the save_changes function fails to validate the nonce correctly. An attacker who can lure a logged‑in site administrator into visiting a forged URL can force the creation or modification of sync rules that send user data to external marketing services such as Mailchimp, Constant Contact, or ActiveCampaign. This may result in unwanted data transfer.

WordPress sites that have installed the FuseWP – WordPress User Sync to Email List & Marketing Automation plugin version 1.1.23.0 or earlier are affected. The vendor is fusewp and no other vendors or products are listed.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% points to a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers must rely on social engineering to trick an administrator into executing a forged request while authenticated, which limits the immediate attack surface but still poses a potential risk to data integrity and compliance.