What is the CVSS score of CVE-2026-6514?

CVE-2026-6514 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of InfusedWoo Pro are affected by CVE-2026-6514?

InfusedWoo Pro plugin for WordPress (versions up to 5.1.2) contains an unauthenticated Server-Side Request Forgery vulnerability that allows remote attackers to read arbitrary server files and access…

How to fix or mitigate CVE-2026-6514?

Within 24 hours: Disable or remove InfusedWoo Pro plugin immediately from all WordPress installations; verify no unauthorized file access in web server logs. Within 7 days: Audit all WordPress instances for plugin presence and document inventory; review server logs and cloud metadata access logs (AWS EC2 metadata, GCP metadata service, etc.) for anomalous requests from the past 90 days. Within 30 days: Implement Web Application Firewall (WAF) rules to block requests to internal IP ranges (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 169.254.169.254) from WordPress; evaluate alternative plugins with security audit; plan upgrade path once InfusedWoo Pro releases patched version 5.1.3 or later.

InfusedWoo Pro CVE-2026-6514

EUVD-2026-30263 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-14 security@wordfence.com

GHSA-mh5f-f33c-v7q4

SSRF WordPress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 09:31 vuln.today

CVE Published

May 14, 2026 - 09:16 nvd

HIGH 7.5

DescriptionCVE.org

The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

AnalysisAI

Server-Side Request Forgery (SSRF) in InfusedWoo Pro plugin for WordPress versions up to 5.1.2 allows unauthenticated remote attackers to exploit the popup_submit function to read arbitrary files from the server and make unauthorized web requests to internal network resources. This vulnerability enables reconnaissance and potential access to internal services that should not be externally accessible, including cloud metadata endpoints, internal APIs, and localhost services. CVSS 7.5 (High) reflects network-accessible attack with no authentication required and high confidentiality impact. EPSS data not available; no active exploitation confirmed via CISA KEV at time of analysis.

Technical ContextAI

This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) affecting the InfusedWoo Pro WordPress plugin, a premium e-commerce integration solution. The vulnerability resides in the popup_submit function which fails to properly validate and sanitize user-supplied URLs before making outbound requests from the WordPress server. WordPress plugins executing in PHP context have full access to the server's network stack, allowing attackers to abuse vulnerable functions as a proxy. SSRF vulnerabilities allow attackers to leverage the application server's network position to access resources that would otherwise be unreachable from the external internet, including RFC-1918 private IP ranges, localhost services, and cloud provider metadata services (AWS EC2 metadata at 169.254.169.254, Azure Instance Metadata Service, etc.). The description mentions both arbitrary file read and web request capabilities, suggesting the function may accept file:// scheme URIs alongside http/https, enabling local file system access through URL handlers.

RemediationAI

Upgrade InfusedWoo Pro plugin to version 5.1.3 or later if available, as versions through 5.1.2 are confirmed vulnerable. Verify patched version by checking the vendor changelog at https://downloads.infusedwoo.com/updater/iw5.php?changelog for SSRF fix confirmation and reviewing Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/76b75e61-e7f8-41cc-ab4f-e6ca42d68308. If immediate patching is not possible, implement network-layer compensating controls: configure web application firewall (WAF) rules to block requests to the popup_submit endpoint from untrusted sources (note: may break legitimate plugin functionality for form submissions), apply egress filtering on the WordPress server to prevent outbound connections to RFC-1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8), link-local addresses (169.254.0.0/16), and cloud metadata endpoints. Consider temporarily disabling the InfusedWoo Pro plugin if not actively required for business operations until patching is completed. Network segmentation reduces but does not eliminate risk as attackers can still exfiltrate data from accessible internal services.