CVE-2026-6510 | The InfusedWoo Pro plugin for WordPress is vulnerable to pri… | CVSS 9.8 CRITICAL

Description

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. This makes it possible for unauthenticated attackers to create a malicious automation recipe that pairs an HTTP post trigger with an auto-login action, allowing any unauthenticated visitor to visit a crafted URL and receive authentication cookies for any targeted user account (e.g., administrator), achieving complete authentication bypass and privilege escalation.

Metadata

CVE ID: CVE-2026-6510
State: PUBLISHED
Assigner: Wordfence
Reserved: 2026-04-17 11:55 UTC
Published: 2026-05-14 06:44 UTC
Last updated: 2026-05-14 10:45 UTC
Primary CWE: CWE-862
CWE-862 Missing Authorization
Vendor / Product: Infused Addons / InfusedWoo Pro
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Infused Addons	InfusedWoo Pro	—	0 ≤ 5.1.2

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	CWE-862 Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)