CVE-2026-6512: Authorization Bypass in InfusedWoo Pro
Platform
wordpress
Component
infusedwooPRO
Fixed in
5.1.3
CVE-2026-6512 represents a critical authorization bypass vulnerability affecting the InfusedWoo Pro plugin for WordPress. This flaw allows unauthenticated attackers to perform destructive actions, including permanent deletion of critical data and modification of post statuses. The vulnerability impacts versions 0.0.0 through 5.1.2, and a patch is available in version 5.1.3.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Impact and Attack Scenarios
The impact of this vulnerability is severe due to the ease of exploitation and the potential for widespread data loss. An attacker can leverage this bypass to permanently delete posts, pages, products, and orders, effectively crippling an e-commerce site. The ability to mass-delete comments on any post can damage a site's reputation and user engagement. Furthermore, attackers can modify post statuses, potentially disrupting content publishing workflows and creating misleading information for users. This vulnerability's simplicity makes it a high-priority target for malicious actors.
Exploitation Context
CVE-2026-6512 was published on 2026-05-14. Currently, there are no publicly known active campaigns exploiting this vulnerability. The ease of exploitation, coupled with the plugin's popularity, suggests it could become a target. No KEV or EPSS score is currently available. Monitor security advisories and threat intelligence feeds for any indications of exploitation.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation is to immediately upgrade the InfusedWoo Pro plugin to version 5.1.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the plugin's administrative functions. Implement strict user role permissions within WordPress to limit the potential damage an attacker could inflict if they gain unauthorized access. While a WAF cannot directly prevent this authorization bypass, it can help detect and block suspicious requests attempting to exploit it. After upgrading, verify the fix by attempting to access plugin functions without proper authentication; successful access indicates the vulnerability persists.
How to fix
Update to version 5.1.3, or a newer patched version
Frequently asked questions
What is CVE-2026-6512 — Authorization Bypass in InfusedWoo Pro?
CVE-2026-6512 is a critical authorization bypass vulnerability in the InfusedWoo Pro WordPress plugin, allowing unauthenticated attackers to delete data and modify post statuses. It affects versions 0.0.0 through 5.1.2.
Am I affected by CVE-2026-6512 in InfusedWoo Pro?
You are affected if you are using InfusedWoo Pro version 0.0.0 through 5.1.2. Check your plugin version and upgrade immediately if necessary.
How do I fix CVE-2026-6512 in InfusedWoo Pro?
Upgrade InfusedWoo Pro to version 5.1.3 or later to resolve this vulnerability. If immediate upgrade is not possible, restrict access to plugin administrative functions.
Is CVE-2026-6512 being actively exploited?
Currently, there are no publicly known active campaigns exploiting CVE-2026-6512, but its ease of exploitation makes it a potential target.
Where can I find the official InfusedWoo Pro advisory for CVE-2026-6512?
Refer to the official InfusedWoo Pro website or WordPress plugin repository for the latest advisory and update information regarding CVE-2026-6512.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Scan your WordPress project now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...