{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/infusedwoo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-19892"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InfusedWoo Pro"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","web-application"],"_cs_type":"advisory","_cs_vendors":["InfusedWoo"],"content_html":"\u003cp\u003eThe InfusedWoo Pro plugin for WordPress contains a critical privilege escalation vulnerability (CVE-2026-19892) affecting all versions up to and including 5.1.17. The vulnerability exists within the \u003ccode\u003eajax_iwar_preview_email()\u003c/code\u003e function, which fails to implement appropriate capability checks, relying solely on an insufficient \u003ccode\u003eis_admin()\u003c/code\u003e check. This allows an authenticated user with low-level privileges, such as a subscriber, to interact with the function to render email preview merge fields for arbitrary users. By manipulating the parameters, an attacker can trigger and retrieve password reset tokens or links intended for other users, including administrators, effectively granting the attacker full account takeover capabilities. This flaw represents a significant risk to WordPress site integrity as it circumvents standard authorization flows.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated subscriber to escalate their privileges to any account level on the WordPress site, including administrative access. This bypass enables unauthorized data access, site configuration changes, and potentially full server compromise depending on the WordPress environment and plugin integrations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the InfusedWoo Pro plugin to a version beyond 5.1.17 immediately.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests targeting the \u003ccode\u003eadmin-ajax.php\u003c/code\u003e endpoint associated with the InfusedWoo plugin parameters.\u003c/li\u003e\n\u003cli\u003eAudit user privilege assignments and recent password reset activity for administrative accounts to identify potential signs of unauthorized access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-25T06:05:39Z","date_published":"2026-08-25T06:05:39Z","id":"https://feed.craftedsignal.io/briefs/2026-08-infusedwoo-priv-esc/","summary":"The InfusedWoo Pro plugin for WordPress, in versions up to 5.1.17, contains a privilege escalation vulnerability allowing authenticated subscribers to perform unauthorized password resets for arbitrary accounts via the ajax_iwar_preview_email function.","title":"Privilege Escalation in InfusedWoo Pro WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-08-infusedwoo-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - InfusedWoo","version":"https://jsonfeed.org/version/1.1"}