CVE-2025-11975

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11975", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-20T16:06:05.319Z", "datePublished": "2025-10-31T02:26:03.735Z", "dateUpdated": "2026-04-08T16:59:12.530Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:12.530Z"}, "affected": [{"vendor": "fusewp", "product": "FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.23.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_changes() function in all versions up to, and including, 1.1.23.0. This makes it possible for unauthenticated attackers to add and edit sync rules."}], "title": "FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c68e8a1-926f-497f-b9f2-b0a67cd09adf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3383939/fusewp/trunk/src/core/src/Admin/SettingsPage/SyncPage.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-10-20T16:21:15.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-30T13:59:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-31T16:34:56.333861Z", "id": "CVE-2025-11975", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T16:35:36.186Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11975", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-31T16:34:56.333861Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T16:35:31.583Z"}}], "cna": {"title": "FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "fusewp", "product": "FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.23.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-20T16:21:15.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-30T13:59:48.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c68e8a1-926f-497f-b9f2-b0a67cd09adf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3383939/fusewp/trunk/src/core/src/Admin/SettingsPage/SyncPage.php"}], "descriptions": [{"lang": "en", "value": "The FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_changes() function in all versions up to, and including, 1.1.23.0. This makes it possible for unauthenticated attackers to add and edit sync rules."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:12.530Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11975", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:59:12.530Z", "dateReserved": "2025-10-20T16:06:05.319Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-31T02:26:03.735Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)", "vendor": "fusewp", "versions": [{"lessThanOrEqual": "1.1.23.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_changes() function in all versions up to, and including, 1.1.23.0. This makes it possible for unauthenticated attackers to add and edit sync rules."}, {"lang": "es", "value": "El plugin FuseWP - WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n save_changes() en todas las versiones hasta la 1.1.23.0, inclusive. Esto hace posible que atacantes no autenticados a\u00f1adan y editen reglas de sincronizaci\u00f3n."}], "id": "CVE-2025-11975", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11975", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-31T16:34:56.333861Z", "version": "2.0.3"}}]}, "published": "2025-10-31T03:15:34.937", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3383939/fusewp/trunk/src/core/src/Admin/SettingsPage/SyncPage.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c68e8a1-926f-497f-b9f2-b0a67cd09adf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:58:20.543484+00:00", "value": {"mitigation_remediation": ["Update the FuseWP plugin to the latest version (>=1.1.24) which includes the missing authorization check.", "If an immediate update is not possible, disable or uninstall the plugin until a patch is available.", "Ensure that only users with appropriate administrator roles have permission to access and modify sync rules to prevent unauthorized changes."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized Configuration Modification"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the FuseWP plugin version 1.1.23.0 or earlier is affected. Site administrators who rely on this plugin for integrating user data with Mailchimp, Constant Contact, ActiveCampaign, or similar services are exposed to the risk of unauthorized rule creation.", "description_and_impact": "The FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation plugin contains a missing capability check in the save_changes() function for all versions up to and including 1.1.23.0. This flaw allows any visitor, even unauthenticated users, to add or modify sync rules. By creating or altering these rules, an attacker can redirect user data to malicious email lists or exfiltrate personal information, compromising data integrity and potentially enabling spam or phishing campaigns. The vulnerability is a classic unauthorized configuration modification identified as CWE-862.", "risk_and_exploitability": "The CVSS score of 4.3 reflects a moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers would exploit the flaw by sending crafted requests to the settings page that invokes save_changes() without any authentication checks, allowing the creation of rogue sync rules. Monitoring logs for unfamiliar rule additions and applying the vendor patch is recommended."}}}}, "created": "2025-10-31T10:12:50.574159+00:00", "updated": "2026-04-22T13:00:09.744889+00:00", "vendors": ["fusewp", "fusewp$PRODUCT$fusewp", "wordpress", "wordpress$PRODUCT$wordpress"]}