What is the CVSS score of CVE-2026-6512?

CVE-2026-6512 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of InfusedWoo Pro are affected by CVE-2026-6512?

InfusedWoo Pro plugin versions up to 5.1.2 contain a critical authorization flaw allowing unauthenticated attackers to permanently delete WordPress content including posts, pages, and WooCommerce…

How to fix or mitigate CVE-2026-6512?

Within 24 hours: Identify all WordPress installations using InfusedWoo Pro and document current plugin versions via admin dashboard or hosting provider tools. Within 7 days: Disable InfusedWoo Pro plugin immediately on all affected sites if running version 5.1.2 or earlier; evaluate alternative plugins or temporary workarounds for dependent functionality. Within 30 days: Monitor Wordfence and official plugin repository for version 5.1.3 or later patch release; upgrade to patched version immediately upon availability and verify content integrity post-upgrade.

InfusedWoo Pro CVE-2026-6512

EUVD-2026-30262 CRITICAL

Missing Authorization (CWE-862)

2026-05-14 security@wordfence.com

GHSA-r6vp-gccc-x4j6

Authentication Bypass WordPress

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 09:31 vuln.today

CVE Published

May 14, 2026 - 09:16 nvd

CRITICAL 9.1

DescriptionCVE.org

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders, mass-delete all comments on any post, and change any post's status.

AnalysisAI

Unauthenticated attackers can permanently delete arbitrary WordPress content (posts, pages, WooCommerce products/orders) and manipulate post statuses in InfusedWoo Pro plugin versions up to 5.1.2 due to missing authorization checks. The CVSS 9.1 (Critical) score reflects network-accessible attack with no complexity barriers, though the Availability impact rating (A:N) appears inconsistent with the ability to mass-delete content. EPSS data unavailable; no CISA KEV listing or public exploit confirmed at time of analysis, but the WordPress ecosystem's large attack surface and clear Wordfence advisory make this a priority patching target for WooCommerce sites.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a fundamental access control failure where the plugin fails to verify user permissions before executing privileged operations. InfusedWoo Pro is a WordPress/WooCommerce integration plugin that bridges Infusionsoft (Keap) CRM with WooCommerce. The flaw exists in administrative functions that should require WordPress capabilities checks (like 'delete_posts', 'manage_woocommerce', 'moderate_comments') but instead expose these operations to any HTTP request without authentication or authorization validation. The CVSS vector AV:N indicates these vulnerable endpoints are accessible over the network without requiring local access or special network positioning. The plugin likely registers REST API endpoints or AJAX handlers that fail to implement WordPress's standard authorization mechanisms (current_user_can(), check_ajax_referer(), etc.), allowing direct invocation by anonymous users.

RemediationAI

Upgrade InfusedWoo Pro to version 5.1.3 or later immediately. The vendor changelog at https://downloads.infusedwoo.com/updater/iw5.php?changelog should confirm patched version details. For commercial WordPress plugins, updates typically deploy through the plugin's built-in license-validated updater rather than the WordPress.org repository. Administrators should verify their InfusedWoo license is active to receive updates, then navigate to WordPress Dashboard → Plugins → check for InfusedWoo Pro updates and apply immediately. If immediate patching is impossible, implement these compensating controls: (1) Temporarily deactivate InfusedWoo Pro plugin until patched version can be deployed-this breaks Infusionsoft/WooCommerce synchronization but eliminates the attack vector; (2) Deploy web application firewall (WAF) rules blocking unauthenticated access to WordPress AJAX endpoints and REST API routes registered by InfusedWoo (requires identifying specific vulnerable endpoints from plugin code-consult Wordfence advisory for indicators); (3) Restrict wp-admin and wp-json access to trusted IP addresses via server configuration, though this may impact legitimate customer functionality. Note that deactivation halts CRM integration and WAF rules require technical expertise to avoid blocking legitimate traffic. Backup all site content and WooCommerce data before applying any changes to enable recovery if exploitation has already occurred.