The InfusedWoo Pro plugin for WordPress contains an authorization bypass that allows any unauthenticated user to delete or modify content. The plugin does not verify user permissions before performing delete actions, enabling permanent removal of posts, pages, products, and orders, mass deletion of comments, and status changes. This flaw can lead to irreversible data loss and disrupt website operations.

WordPress sites running Infused Addons' InfusedWoo Pro plugin, versions up to and including 5.1.2. The vulnerability impacts any installation that has the plugin enabled, regardless of the WordPress site size or traffic level.

The flaw carries a CVSS score of 9.1, indicating severe risk, but its EPSS score is not available, leaving the exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog. The lack of authentication checks makes it possible for attackers to exploit the issue using crafted HTTP requests or URL parameters, originating from any unauthenticated source. Based on the description, it is inferred that the attack vector is remote and relies on these crafted requests or parameters, allowing an external adversary to delete content without credentials.