CVE Intelligence
Analysis AI-assisted

CVE-2026-6512: InfusedWoo Pro - Missing Authorization (CWE-862) Allows Unauthenticated Post Deletion

CVE-2026-6512 is a missing authorization flaw (CWE-862) in the InfusedWoo Pro plugin for WordPress, affecting all versions up to and including 5.1.2. According to the record, unauthenticated users could permanently delete content, mass-delete comments and change post status. Wordfence reports a CVSS 3.1 score of 9.1 (Critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a missing authorization weakness (CWE-862) in the InfusedWoo Pro plugin for WordPress. According to the description, the plugin does not properly verify that a user is authorized to perform certain actions, affecting all versions up to and including 5.1.2.

Impact

  • According to the description, unauthenticated attackers could permanently delete arbitrary posts, pages, products or orders.
  • The description also states that attackers could mass-delete all comments on any post and change any post's status.
  • Wordfence reports a CVSS 3.1 base score of 9.1 (Critical). The vector in the record indicates high confidentiality and integrity impact with no availability impact.

Affected products and versions

  • Infused Addons InfusedWoo Pro, versions up to and including 5.1.2.
  • The record does not list any fixed version.

Exploitation status

  • The record shows the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
  • No confirmed exploitation appears in the sources consulted.
  • The SSVC fields in the record state exploitation as 'none' and automatable as 'yes'.

Remediation and mitigation

  • Review the vendor changelog referenced in the record and confirm whether a release newer than 5.1.2 addresses this issue, since the record provides no fixed version.
  • Until a fix is verified, limit who can reach the site's plugin functionality, restrict access to the affected administrative endpoints where possible, and keep current backups of posts, pages, products, orders and comments.
  • Keep WordPress, WooCommerce and all plugins updated, and remove the plugin if it is not needed.

Detection guidance

  • Review web server and WordPress logs for unexpected requests to InfusedWoo Pro functionality, especially from sessions without a logged-in user.
  • Monitor for unexplained deletions of posts, pages, products or orders, bulk comment removal, and unexpected status changes.
  • Compare content counts and backups over time to identify silent changes.

Limitations of the available information

  • The record does not identify the specific parameters or endpoints involved, and this analysis does not describe them.
  • No fixed version is listed, so the remediation status of each installation must be verified against the vendor changelog.
  • The EPSS entry shows a probability of 0.00461 and a percentile of 0.38186, but its date (2026-10-13) is later than the publication date, so it should be treated with caution.

Frequently asked questions

Which versions of InfusedWoo Pro are affected by CVE-2026-6512?

The record lists all versions up to and including 5.1.2 as affected. It does not list a fixed version, so check the vendor changelog to confirm the status of your installation.

Is CVE-2026-6512 known to be actively exploited?

The record shows the CVE is not listed in CISA's KEV catalog, and no confirmed exploitation appears in the sources consulted.

What is the main risk of this vulnerability?

According to the description, unauthenticated users could permanently delete posts, pages, products or orders, mass-delete comments and change post status. Keeping verified backups is an important safeguard.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.