InfusedWoo - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/infusedwoo/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 25 Aug 2026 06:05:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrivilege Escalation in InfusedWoo Pro WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-08-infusedwoo-priv-esc/Tue, 25 Aug 2026 06:05:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-infusedwoo-priv-esc/The InfusedWoo Pro plugin for WordPress, in versions up to 5.1.17, contains a privilege escalation vulnerability allowing authenticated subscribers to perform unauthorized password resets for arbitrary accounts via the ajax_iwar_preview_email function.The InfusedWoo Pro plugin for WordPress contains a critical privilege escalation vulnerability (CVE-2026-19892) affecting all versions up to and including 5.1.17. The vulnerability exists within the ajax_iwar_preview_email() function, which fails to implement appropriate capability checks, relying solely on an insufficient is_admin() check. This allows an authenticated user with low-level privileges, such as a subscriber, to interact with the function to render email preview merge fields for arbitrary users. By manipulating the parameters, an attacker can trigger and retrieve password reset tokens or links intended for other users, including administrators, effectively granting the attacker full account takeover capabilities. This flaw represents a significant risk to WordPress site integrity as it circumvents standard authorization flows.

Impact

Successful exploitation allows an authenticated subscriber to escalate their privileges to any account level on the WordPress site, including administrative access. This bypass enables unauthorized data access, site configuration changes, and potentially full server compromise depending on the WordPress environment and plugin integrations.

Recommendation

  • Upgrade the InfusedWoo Pro plugin to a version beyond 5.1.17 immediately.
  • Monitor web server access logs for anomalous POST requests targeting the admin-ajax.php endpoint associated with the InfusedWoo plugin parameters.
  • Audit user privilege assignments and recent password reset activity for administrative accounts to identify potential signs of unauthorized access.
]]>highadvisorywordpressprivilege-escalationweb-application