What the vulnerability does
01Description
The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the `ajax_iwar_preview_email()` function, which uses `is_admin()` as its only authorization check and allows low-privilege users to render email preview merge fields for an arbitrary email address. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate and retrieve a valid password reset link for any WordPress user, including administrators, enabling account takeover.
Explanation of Vulnerability in Simple Terms
02Summary
InfusedWoo Pro versions up to 5.1.17 lack proper authorization checks, allowing authenticated users with low privileges to read, modify, or delete sensitive data and functionality. An attacker with a basic user account can perform actions restricted to administrators or other higher-privilege roles. Update to a version newer than 5.1.17 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete data and functionality normally restricted to administrators.
Potential impact on your site
04Site Impact
Any registered user can access and alter admin-level settings, user data, and site content.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
August 25, 2026
CVE published
August 27, 2026
Record updated
