The FuseWP plugin for WordPress, which synchronizes users to email lists and marketing automation platforms, contains a CSRF vulnerability in all versions up to 1.1.24.2. The root cause is the absence of nonce verification in the toggle_sync_status() function. An unauthenticated attacker can exploit this by crafting a malicious request that, if an administrator executes (e.g., by clicking a link), toggles the status of sync rules (enable or disable) without proper authorization.

An attacker can cause an administrator to unknowingly enable or disable synchronization rules between WordPress users and email marketing platforms. This could disrupt marketing automation workflows or cause unintended data synchronization changes. The vulnerability does not allow direct data disclosure or system compromise but impacts the integrity of sync rule configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links and consider implementing additional CSRF protections or monitoring changes to sync rule statuses.