CVE-2026-6510

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. This makes it possible for unauthenticated attackers to create a malicious automation recipe that pairs an HTTP post trigger with an auto-login action, allowing any unauthenticated visitor to visit a crafted URL and receive authentication cookies for any targeted user account (e.g., administrator), achieving complete authentication bypass and privilege escalation.

• CWE-862

• https://woo.infusedaddons.com/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/08cb8ba1-1976-438b-8e0b-0a8be08aad6c?source=cve

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65067Data::Intern::Shared versions before 0.02 for Perl create a …3.8
• CVE-2026-65068Data::SpatialHash::Shared versions before 0.02 for Perl crea…3.8
• CVE-2026-65069Data::DisjointSet::Shared versions before 0.02 for Perl crea…4
• CVE-2026-6507A flaw was found in dnsmasq. A remote attacker could exploit…7.5
• CVE-2026-6508Origin Validation Error vulnerability in TUBITAK BILGEM Soft…9.8
• CVE-2026-6509Missing Authorization vulnerability in TUBITAK BILGEM Softwa…7.8
• CVE-2026-65100Apache Traffic Server updates the HTTP/2 HPACK dynamic table…6.3
• CVE-2026-6511During an internal security assessment, a potential improper…6.8
• CVE-2026-6512The InfusedWoo Pro plugin for WordPress is vulnerable to aut…9.1
• CVE-2026-6514The InfusedWoo Pro plugin for WordPress is vulnerable to Arb…7.5
• CVE-2026-6515GitLab has remediated an issue in GitLab CE/EE affecting all…5.4
• CVE-2026-6516Zohocorp ManageEngine ADAudit Plus versions before 8606 are …10