PT-2026-40891 · Infused Addons · Infusedwoo Pro

Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-6506

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. This is due to the infusedwoo gdpr upddata() function missing authorization and capability checks, as well as lacking restrictions on which user meta keys can be updated. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their own wp capabilities user meta to grant themselves Administrator role privileges.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-6506

Affected Products

Infusedwoo Pro

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-6506 · Security Note
• https://drive.google.com/file/d/1QrKLX-GcBiAMKzEI4mZBPO-S0_7W6Xv7/view?usp=sharing · Note
• https://woo.infusedaddons.com · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6363b693-91b8-41cb-b13a-df6fdf9402c5?source=cve · Note