What the vulnerability does
01Description
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. This is due to the infusedwoo_gdpr_upddata() function missing authorization and capability checks, as well as lacking restrictions on which user meta keys can be updated. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their own wp_capabilities user meta to grant themselves Administrator role privileges.
Explanation of Vulnerability in Simple Terms
02Summary
InfusedWoo Pro versions up to 5.1.2 lack proper authorization checks, allowing authenticated users with low privileges to read, modify, or delete sensitive data and functionality. An attacker with a basic user account can perform actions restricted to administrators or higher-privilege roles. Update to a version newer than 5.1.2 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete data and functionality restricted to higher-privilege users.
Potential impact on your site
04Site Impact
Any registered user can access and alter admin-level settings, customer data, or orders without authorization.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
06Disclosure timeline
May 14, 2026
CVE published
May 14, 2026
Record updated
