CVE-2025-11975: 
WordPress vulnerability analysis and mitigation

CVE-2025-11975 affects the FuseWP – WordPress User Sync to Email List & Marketing Automation plugin for WordPress. The vulnerability was discovered and disclosed on October 30, 2025, impacting all versions up to and including 1.1.23.0. The issue stems from a missing capability check in the save_changes() function, which creates a security gap in the plugin's authorization system (NVD, Rapid7).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 Base Score of 4.3 (Medium). The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, low privileges required, no user interaction needed, unchanged scope, no impact on confidentiality, low impact on integrity, and no impact on availability (NVD).

The vulnerability allows unauthorized modification of data within the WordPress plugin. Specifically, attackers can add and edit sync rules, potentially compromising the integrity of email list synchronization and marketing automation functions (NVD, Rapid7).

The vulnerability was initially reported by security researcher Jonas Benjamin Friedli and was subsequently analyzed by Wordfence, leading to its public disclosure (Wordfence).