CVE-2026-19892: InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure
The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajaxiwarpreviewemail() function, which uses isadmin() as its only authorization check and allows low-privilege users to render email preview merge fields for an arbitrary email address. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate and retrieve a valid password reset link for any WordPress user, including administrators, enabling account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InfusedWoo Proto a version that resolves this vulnerability.Fixed in 5.1.18
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Subscriber-level access or higher. They can target arbitrary WordPress user email addresses, including administrator accounts.
What access does an attacker gain after exploitation?
The attacker can obtain a valid password reset link for a targeted user and use it to take over that account. This can result in compromise of administrator accounts.
What authorization flaw enables the attack?
The affected AJAX function relies on is_admin() as its only authorization check and lacks a capability check. This lets low-privilege authenticated users render email preview merge fields for arbitrary email addresses.
Which versions are affected?
The description states that InfusedWoo Pro versions up to and including 5.1.17 are vulnerable. The supplied data does not identify a fixed version.