The FuseWP WordPress plugin suffers from a Cross‑Site Request Forgery flaw because the toggle_sync_status() action does not validate a nonce. An attacker can send a forged request that causes a site administrator, if tricked into clicking a link or visiting a malicious page, to enable or disable email sync rules. This results in unauthorized configuration changes that can halt email campaigns or cause stale data to be sent to marketing platforms such as Mailchimp or Constant Contact, but it does not provide code execution or privilege escalation.

All WordPress sites running FuseWP plugin versions 1.1.24.2 or earlier are affected. The vulnerability resides solely in the AjaxHandler component that manages the sync‑rule status toggle; no other plugins or core WordPress components are impacted.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of < 1% suggests low exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires social engineering of an administrator, who must click a crafted link or load a malicious page – no authentication is required. While it does not grant code execution, the potential to disrupt marketing workflows warrants prompt remediation.