InfusedWoo Pro Plugin Privilege Escalation (CVE-2026-6506)

The InfusedWoo Pro plugin for WordPress, in all versions up to and including 5.1.2, is vulnerable to a severe privilege escalation flaw, identified as CVE-2026-6506. The National Vulnerability Database reports this is due to the infusedwoo_gdpr_upddata() function lacking critical authorization and capability checks. Furthermore, it fails to restrict which user meta keys can be updated.

This oversight creates a clear path for authenticated attackers, even those with subscriber-level access, to manipulate their wp_capabilities user meta and grant themselves full Administrator privileges. The National Vulnerability Database assigns this a CVSS score of 8.8 (HIGH), underscoring the critical risk. This isn’t just a theoretical bug; it’s a direct route to complete site compromise.

Defenders running WordPress sites with this plugin must understand the attacker’s calculus here: a low-privileged account is all that’s needed to take over the entire system. This vulnerability isn’t complex to exploit; it leverages a fundamental authorization bypass. Patching is non-negotiable, and a thorough audit for unauthorized privilege changes is essential.