PT-2026-40891 · WordPress · Infusedwoo Pro

Published 2026-05-14 · Updated 2026-06-19 · CVE-2026-6506

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InfusedWoo Pro versions prior to 5.1.3

Description The InfusedWoo Pro plugin for WordPress contains a flaw allowing authenticated attackers with subscriber-level access or higher to escalate their privileges. The issue stems from the infusedwoo gdpr upddata() function, which lacks proper authorization and capability checks and does not restrict which user meta keys can be modified. Consequently, an attacker can update their own wp capabilities user meta to grant themselves Administrator role privileges.

Recommendations Update the plugin to a version later than 5.1.2. As a temporary workaround, restrict access to the infusedwoo gdpr upddata() function to minimize the risk of exploitation.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-6506

Affected Products

Infusedwoo Pro

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-6506 · Security Note
• https://twitter.com/Tank23x0/status/2068001109088878876 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2054826573555958084 · Twitter Post
• https://t.me/CVEtracker/53762 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054891023390679048 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6363b693-91b8-41cb-b13a-df6fdf9402c5?source=cve · Note
• https://t.me/cveNotify/163414 · Telegram Post
• https://woo.infusedaddons.com · Note
• https://drive.google.com/file/d/1QrKLX-GcBiAMKzEI4mZBPO-S0_7W6Xv7/view?usp=sharing · Note