WordPress InfusedWoo Pro Plugin Vulnerable to Arbitrary File Read (CVE-2026-6514)

The National Vulnerability Database has identified CVE-2026-6514, a critical arbitrary file read vulnerability affecting all versions of the InfusedWoo Pro WordPress plugin up to and including 5.1.2. This flaw, exploitable via the popup_submit function by unauthenticated attackers, allows malicious actors to initiate web requests from the affected application to arbitrary locations. This capability can be leveraged to exfiltrate sensitive data from internal services or even modify internal information.

The CVSS score of 7.5 (HIGH) underscores the severity of this vulnerability. Attackers can exploit this without prior authentication or privileges, making it a prime target for initial access or further lateral movement within a compromised network. The CWE-918 classification highlights the specific nature of the vulnerability as a Server-Side Request Forgery (SSRF) variant, enabling unauthorized access to internal resources.

Defenders must prioritize patching affected WordPress installations immediately. Given the unauthenticated nature of the exploit, any organization using InfusedWoo Pro below version 5.1.3 is at significant risk. A thorough audit of web server logs for suspicious outbound requests originating from the WordPress application is also recommended to detect potential exploitation attempts.