The InfusedWoo Pro plugin for WordPress is vulnerable because its iwar_save_recipe AJAX handler lacks nonce verification and capability checks. This flaw allows an unauthenticated attacker to fabricate a recipe that triggers an auto‑login action, causing any visitor to receive authentication cookies for a privileged account such as an administrator. The result is a complete authentication bypass and the ability to compromise the site with full administrative privileges.

Infused Addons: InfusedWoo Pro plugin for WordPress, affecting all released versions up to and including 5.1.2. Any WordPress installation that has this plugin installed and has the vulnerable version running is at risk.

With a CVSS score of 9.8 the vulnerability is rated critical. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. An attacker can exploit it simply by visiting a crafted URL targeting the iwar_save_recipe AJAX endpoint, which is accessible to unauthenticated users. The attack requires no prior knowledge of site credentials and can be performed remotely via an HTTP request.