InfusedWoo Pro CVE-2026-6506

The target site must have InfusedWoo Pro ≤5.1.2 installed and active, and the attacker must hold a valid authenticated session at subscriber level or higher (CVSS PR:L) - meaning open user registration or any existing low-privilege account is sufficient. Exploitation specifically requires reaching the infusedwoo_gdpr_upddata() endpoint and supplying a user_meta key/value pair that writes wp_capabilities. Limiting factors: sites with self-registration disabled and no compromised low-privilege accounts cannot be exploited remotely; no user interaction from an admin is needed (UI:N); the attack works against default plugin configurations since the missing authorization is in the handler itself, not gated by an opt-in setting.

Signals are mixed but lean toward serious-but-not-urgent. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 8.8 and matches the description: network-reachable, low complexity, requires only low (subscriber) privileges, no user interaction, total CIA impact on the WordPress instance. SSVC reinforces this with Technical Impact = total but Exploitation = none and Automatable = no, which is consistent with the very low EPSS (0.04%, 11th percentile) and the absence of KEV listing or public PoC. The realistic priority hinges on deployment posture: sites that allow open subscriber registration (typical for WooCommerce storefronts) should treat this as high priority because the PR:L barrier is trivially satisfied; sites that disable self-registration face materially lower exposure. No conflicting data was observed between CVSS and the description.

An attacker registers (or uses) a subscriber account on a WordPress site running InfusedWoo Pro ≤5.1.2, then sends an authenticated request to the infusedwoo_gdpr_upddata() handler with a crafted payload that sets the wp_capabilities user meta to {"administrator":true}. On the next page load the account is treated as an administrator, enabling plugin/theme upload and full site takeover. No public exploit is identified at time of analysis, but the bug class is well-understood and trivially reproducible once the handler signature is known.