PT-2026-40898 · WordPress · Infusedwoo Pro

Os + 1 · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-6512

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions InfusedWoo Pro versions prior to 5.1.3

Description The InfusedWoo Pro plugin for WordPress contains an authorization bypass issue because it fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to permanently delete arbitrary products, orders, pages, or posts, change the status of any post, and mass-delete all comments on any post.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-6512

Affected Products

Infusedwoo Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-6512 · Security Note
• https://twitter.com/KaitanSecurity/status/2054864303677645138 · Twitter Post
• https://downloads.infusedwoo.com/updater/iw5.php?changelog · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f624c9a0-b48f-49f5-ba63-276805904945?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2054867985626509430 · Twitter Post
• https://t.me/cveNotify/163421 · Telegram Post
• https://t.me/CVEtracker/53769 · Telegram Post