InfusedWoo Pro CVE-2026-6510

Exploitation requires only that the InfusedWoo Pro plugin (version ≤5.1.2) is installed and activated on a reachable WordPress site, and that the site's admin-ajax.php endpoint is accessible from the attacker's network - which is the default. No authentication, no user interaction, and no non-default configuration are needed: the vulnerable iwar_save_recipe() AJAX handler is exposed to unauthenticated callers by design due to the missing nonce and capability check. The only meaningful limiting factors are knowledge of the recipe payload schema (trivially recoverable from the plugin's PHP/JS source) and knowing or guessing a valid target username such as 'admin' for the auto-login action; sites that have already renamed the default admin account still remain exploitable against any enumerable username.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H paints a worst-case picture - network-reachable, low-complexity, no authentication, no user interaction, full CIA impact - which is consistent with the SSVC technical impact of 'total' and the 'automatable: yes' rating, since the attack reduces to two HTTP requests. However, SSVC exploitation is 'none' and EPSS is only 0.19% (40th percentile), and the CVE is not on CISA KEV, indicating no public exploit identified at time of analysis. The mismatch is explainable: WordPress plugin vulnerabilities reported by Wordfence often score very high on CVSS yet show low EPSS until a public PoC or mass-scanning campaign emerges. Defenders should treat this as a real priority because the technical impact is total account takeover on any site running the plugin, exploitation is fully automatable, and InfusedWoo Pro is a niche commerce plugin whose installed base may be enumerated rapidly once a PoC drops.

An attacker scans the internet for WordPress sites running InfusedWoo Pro, then sends a single unauthenticated POST to /wp-admin/admin-ajax.php?action=iwar_save_recipe defining a recipe whose trigger is an HTTP post and whose action auto-logs in the site's administrator account. The attacker then visits the trigger URL with a normal browser and is issued valid WordPress auth cookies for the admin user, after which they install a malicious plugin or PHP webshell for persistence. No public exploit identified at time of analysis, but SSVC rates the attack 'automatable' and the two-request sequence is trivial to weaponize once recipe schema is reverse-engineered.