Description
The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the `ajax_iwar_preview_email()` function, which uses `is_admin()` as its only authorization check and allows low-privilege users to render email preview merge fields for an arbitrary email address. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate and retrieve a valid password reset link for any WordPress user, including administrators, enabling account takeover.
Published: 2026-08-25
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation via Authentication Bypass leading to account takeover
Action: Immediate Patch
AI Analysis

Impact

InfusedWoo Pro for WordPress contains a missing capability check in the ajax_iwar_preview_email() function, which only verifies is_admin() before rendering email preview merge fields. The function accepts an arbitrary email address, allowing any authenticated user with Subscriber level or higher to fetch a valid password‑reset link for any WordPress account, including administrators. This weakness (CWE‑862) can be leveraged to perform account takeover and subsequently gain full administrative control of the site.

Affected Systems

The vulnerability affects all installations of InfusedWoo Pro dated 5.1.18 and earlier, as indicated in the advisory. The plugin is available under the product name Infused Woo Pro from the vendor Infused Addons.

Risk and Exploitability

The CVSS score of 8.8 classifies this flaw as high severity. EPSS data is not available, and it is not listed in CISA KEV, suggesting no publicly confirmed exploits yet. However, the flaw requires only authenticated access with a Subscriber role or greater, which is common on many WordPress sites. Attackers can trigger the vulnerable endpoint via the normal AJAX interface, producing reset links that bypass WordPress’s standard security controls.

Generated by OpenCVE AI on August 25, 2026 at 04:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade InfusedWoo Pro to the latest patch version that removes the unchecked capability check (verify release notes for the fix).
  • If an upgrade cannot be performed immediately, add a custom filter or code snippet that returns an error unless WP current user has the administrator capability before the ajax_iwar_preview_email() action runs.
  • Disable or tightly monitor the password reset feature for non‑admin users and enforce strong, unique passwords for all accounts while you remedy the underlying plugin issue.

Generated by OpenCVE AI on August 25, 2026 at 04:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Infused Addons
Infused Addons infusedwoo Pro
Wordpress
Wordpress wordpress
Vendors & Products Infused Addons
Infused Addons infusedwoo Pro
Wordpress
Wordpress wordpress

Tue, 25 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Description The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the `ajax_iwar_preview_email()` function, which uses `is_admin()` as its only authorization check and allows low-privilege users to render email preview merge fields for an arbitrary email address. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate and retrieve a valid password reset link for any WordPress user, including administrators, enabling account takeover.
Title InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Infused Addons Infusedwoo Pro
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-27T14:58:11.711Z

Reserved: 2026-08-14T18:42:04.951Z

Link: CVE-2026-19892

cve-icon Vulnrichment

Updated: 2026-08-27T14:58:00.499Z

cve-icon NVD

Status : Deferred

Published: 2026-08-25T04:18:10.770

Modified: 2026-08-27T17:17:43.320

Link: CVE-2026-19892

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T05:00:11Z

Weaknesses