InfusedWoo Pro CVE-2026-19892

Exploitation requires a registered WordPress user account with subscriber-level privileges or higher on the target site - anonymous unauthenticated access is not sufficient. The attacker must also know or successfully enumerate a valid email address belonging to a higher-privileged user such as an administrator; WordPress usernames and admin emails are sometimes exposed through the REST API or author archive pages by default. The vulnerability is triggered through the standard WordPress AJAX mechanism (wp-admin/admin-ajax.php), which is accessible in all default WordPress deployments and requires no special server configuration. No non-default InfusedWoo Pro feature flag or configuration setting is required - the vulnerable ajax_iwar_preview_email() function is present and registered in all installations of the affected version range. Exploitation is limited by the need for a valid subscriber account, which depends on whether open user registration is enabled or whether the attacker possesses credentials obtained through other means.

The CVSS 3.1 base score of 8.8 (High) is well-calibrated to the actual threat: the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a network-accessible, low-complexity attack requiring only a subscriber account, with full account takeover as the outcome. No EPSS score is present in the provided intelligence, and the vulnerability is not listed in the CISA KEV catalog, so active exploitation has not been officially confirmed; however, the trivial attack prerequisites mean that even a mid-sized municipal IT team in zabrze should treat this as urgent if their organization operates a WooCommerce store with this plugin installed. The combination of a minimal privilege requirement (subscriber) and a deterministic, high-impact outcome (admin account takeover via password reset) places this squarely in the category of vulnerabilities that attract rapid opportunistic exploitation once public awareness increases. No CVSS signal conflicts are present - the network vector and low-privilege requirement are both consistent with the AJAX-based attack path described in the disclosure.

An attacker registers a subscriber-level account on a vulnerable WordPress site running InfusedWoo Pro 5.1.17 or earlier, then sends a crafted AJAX POST request to wp-admin/admin-ajax.php targeting the ajax_iwar_preview_email() function with a target administrator's email address as the payload parameter. The function renders a valid password reset link for that administrator account and returns it in the response, which the attacker uses to reset the admin password and achieve full WordPress site control. No public exploit code has been identified at time of analysis, but the attack requires only a subscriber account and knowledge of an administrator's email address.