CVE Intelligence
Analysis AI-assisted

CVE-2026-6510: InfusedWoo Pro for WordPress: Missing Authorization Leading to Privilege Escalation

The InfusedWoo Pro plugin for WordPress has a missing authorization flaw that, according to the record, lets unauthenticated users gain elevated privileges, including access to administrator accounts. Wordfence rates it critical with a CVSS 3.1 score of 9.8. The record does not identify a fixed version, so site owners should confirm the vendor status and reduce exposure now.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The InfusedWoo Pro plugin for WordPress has a missing authorization weakness (CWE-862) that can lead to privilege escalation. According to the record description, versions up to and including 5.1.2 lack nonce verification and capability checks in an AJAX handler, which weakens access control for unauthenticated users. The Wordfence analysis is available at Wordfence threat intelligence.

Impact

  • Wordfence scored the issue 9.8 (critical) under CVSS 3.1, with network attack vector, low complexity, no privileges required and no user interaction.
  • The record describes authentication bypass and privilege escalation to targeted accounts, including administrator accounts.
  • The CVSS vector indicates high impact on confidentiality, integrity and availability.

Affected products and versions

  • Product: InfusedWoo Pro plugin for WordPress.
  • Affected range stated in the description: all versions up to and including 5.1.2.
  • The structured affected and fixes fields in the record are empty, so the exact fixed version is unknown from the sources consulted.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted, so no claim of active exploitation is made here.

Remediation and mitigation

  • Check whether InfusedWoo Pro is installed and which version is active.
  • Update to the latest release provided by the vendor. The record does not identify a fixed release, so confirm with the vendor website.
  • If no fixed version is available or the plugin is not needed, deactivate and remove it.
  • Review user accounts for unexpected administrator or privileged accounts, and review active sessions.
  • Review existing automation recipes created by the plugin for entries that you did not create.

Detection guidance

  • Review web server and application logs for unusual requests to AJAX endpoints associated with the plugin, especially from unauthenticated sessions.
  • Look for newly created automation rules or configuration changes that were not authorized.
  • Monitor for new or modified administrator accounts and unexpected login events.

Limitations of the available information

  • The record does not list affected or fixed versions in structured fields.
  • Vendor details are limited to the references provided, and this analysis does not include independent testing.
  • The full record is available in the NVD entry.

Frequently asked questions

Is this vulnerability being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The description states that all versions up to and including 5.1.2 are affected. The record does not provide a fixed version.

What should site owners do now?

Check whether the plugin is installed, update to a vendor-provided fixed release if one is available, or deactivate and remove it if it is not needed. Also review accounts and automation rules for unexpected changes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.