The FuseWP – WordPress User Sync to Email List & Marketing Automation plugin suffers from a missing capability check in its save_changes() function across all versions up to 1.1.23.0. This CWE-862 vulnerability allows unauthenticated attackers to modify sync rules without proper authorization, potentially altering how user data is synchronized with marketing platforms such as Mailchimp, Constant Contact, and ActiveCampaign. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. There is no indication of a patch or vendor advisory detailing remediation at this time.

The vulnerability allows unauthorized modification of synchronization rules within the FuseWP plugin, which could lead to unauthorized changes in how user data is synced with external marketing services. This impacts data integrity but does not affect confidentiality or availability. There are no known exploits in the wild reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress admin interface and monitor plugin updates from the vendor. Avoid using affected versions in publicly accessible environments where unauthenticated users can interact with the plugin.