CVE-2025-11975: 
WordPress vulnerability analysis and mitigation

CVE-2025-11975 is a missing authorization vulnerability in the FuseWP – WordPress User Sync to Email List & Marketing Automation plugin for WordPress. It affects all versions up to and including 1.1.23.0, allowing unauthenticated attackers to add and edit sync rules due to a missing capability check on the save_changes() function. The vulnerability was disclosed on October 30–31, 2025, and was reported by Wordfence. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the save_changes() function in the plugin's SyncPage.php file does not perform any capability or permission check before processing user-supplied input. This means any network-accessible user — including unauthenticated visitors — can invoke this function and manipulate sync rule configurations. The fix was applied in the plugin's source code as documented in the WordPress plugin repository changeset (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to add or modify email list synchronization rules within the FuseWP plugin, potentially redirecting WordPress user data (such as email addresses and user attributes) to attacker-controlled marketing lists or altering integration behavior with services like Mailchimp, Constant Contact, or ActiveCampaign. The impact is limited to integrity — there is no direct confidentiality or availability impact — but manipulation of sync rules could result in unauthorized data exfiltration to third-party platforms or disruption of legitimate email marketing workflows (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-11975. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low barrier to exploitation (no authentication required per the description, though the CVSS vector notes low privileges required) may attract opportunistic attackers targeting WordPress sites at scale (Wordfence).

1. Reconnaissance: Identify WordPress sites running the FuseWP plugin version ≤ 1.1.23.0 using tools like WPScan or by checking publicly accessible readme files at /wp-content/plugins/fusewp/readme.txt.
2. Locate the vulnerable endpoint: Identify the admin AJAX or form submission endpoint that invokes the save_changes() function in SyncPage.php, typically accessible via the WordPress admin interface or a direct POST request.
3. Craft a malicious request: Send an unauthenticated (or low-privilege) HTTP POST request to the vulnerable endpoint with parameters specifying new or modified sync rules (e.g., redirecting user sync to an attacker-controlled email list API key or endpoint).
4. Achieve objective: The modified sync rules take effect, causing WordPress user data to be synchronized to attacker-specified marketing platforms or altering existing integrations without administrator awareness (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unexpected POST requests to FuseWP sync settings endpoints (e.g., URLs containing fusewp or sync admin page parameters) from unauthenticated or low-privilege users.
• Configuration: Unexpected changes to FuseWP sync rules in the WordPress database (wp_options table entries related to FuseWP), particularly new or modified rules pointing to unfamiliar API keys or list IDs.
• Network: Outbound connections from the WordPress server to unfamiliar marketing platform API endpoints (e.g., Mailchimp, ActiveCampaign) not previously configured by administrators.

Update the FuseWP plugin to version 1.1.23.1 or later, which includes the fix that adds proper capability checks to the save_changes() function. The patch is documented in the WordPress plugin repository changeset. As an interim measure, site administrators can deactivate the FuseWP plugin until the update is applied, or restrict access to WordPress admin endpoints via IP allowlisting at the web server or firewall level (WordPress Trac, Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report covering October 27 – November 2, 2025, noting it as one of many plugin-level authorization issues discovered during that period (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified.