The FuseWP plugin for WordPress, used for syncing users to email lists and marketing automation platforms, contains a CSRF vulnerability in all versions up to and including 1.1.24.2. The root cause is the absence of nonce verification in the toggle_sync_status() function, which controls enabling or disabling sync rules. An attacker can exploit this by crafting a malicious request that, if an administrator executes (e.g., by clicking a link), toggles sync rule statuses without proper authorization.

An attacker can cause an administrator to unknowingly enable or disable synchronization rules between WordPress users and email marketing services. This could disrupt marketing automation workflows or cause unintended changes in user data synchronization. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider implementing additional CSRF protections or disabling the affected functionality if possible.