Privilege Escalation in InfusedWoo Pro WordPress Plugin

The InfusedWoo Pro plugin for WordPress contains a critical privilege escalation vulnerability (CVE-2026-19892) affecting all versions up to and including 5.1.17. The vulnerability exists within the ajax_iwar_preview_email() function, which fails to implement appropriate capability checks, relying solely on an insufficient is_admin() check. This allows an authenticated user with low-level privileges, such as a subscriber, to interact with the function to render email preview merge fields for arbitrary users. By manipulating the parameters, an attacker can trigger and retrieve password reset tokens or links intended for other users, including administrators, effectively granting the attacker full account takeover capabilities. This flaw represents a significant risk to WordPress site integrity as it circumvents standard authorization flows.

Impact

Successful exploitation allows an authenticated subscriber to escalate their privileges to any account level on the WordPress site, including administrative access. This bypass enables unauthorized data access, site configuration changes, and potentially full server compromise depending on the WordPress environment and plugin integrations.

Recommendation

• Upgrade the InfusedWoo Pro plugin to a version beyond 5.1.17 immediately.
• Monitor web server access logs for anomalous POST requests targeting the admin-ajax.php endpoint associated with the InfusedWoo plugin parameters.
• Audit user privilege assignments and recent password reset activity for administrative accounts to identify potential signs of unauthorized access.