CVE-2026-19892

The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the `ajax_iwar_preview_email()` function, which uses `is_admin()` as its only authorization check and allows low-privilege users to render email preview merge fields for an arbitrary email address. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate and retrieve a valid password reset link for any WordPress user, including administrators, enabling account takeover.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://downloads.infusedwoo.com/updater/iw5.php?changelog
https://www.wordfence.com/threat-intel/vulnerabilities/id/207fc33b-ccf6-4c39-976d-41e6a89ad1ec?source=cve

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) El plugin InfusedWoo Pro para WordPress es vulnerable a la escalada de privilegios a través de la toma de control de cuentas en todas las versiones hasta la 5.1.17, inclusive. Esto se debe a una comprobación de capacidad faltante en la función 'ajax_iwar_preview_email()', que utiliza 'is_admin()' como su única comprobación de autorización y permite a usuarios con bajos privilegios renderizar campos de combinación de vista previa de correo electrónico para una dirección de correo electrónico arbitraria. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, generen y recuperen un enlace válido de restablecimiento de contraseña para cualquier usuario de WordPress, incluidos los administradores, lo que permite la toma de control de la cuenta.

Information

Published : 2026-08-25 04:18

Updated : 2026-10-12 15:10

NVD link : CVE-2026-19892

Mitre link : CVE-2026-19892

CVE.ORG link : CVE-2026-19892

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-19892", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19892", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-27T14:57:55.315941Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "Infused Addons", "product": "InfusedWoo Pro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.1.17"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-25T04:18:10.770", "references": [{"url": "https://downloads.infusedwoo.com/updater/iw5.php?changelog", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/207fc33b-ccf6-4c39-976d-41e6a89ad1ec?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the `ajax_iwar_preview_email()` function, which uses `is_admin()` as its only authorization check and allows low-privilege users to render email preview merge fields for an arbitrary email address. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate and retrieve a valid password reset link for any WordPress user, including administrators, enabling account takeover."}, {"lang": "es", "value": "El plugin InfusedWoo Pro para WordPress es vulnerable a la escalada de privilegios a trav\u00e9s de la toma de control de cuentas en todas las versiones hasta la 5.1.17, inclusive. Esto se debe a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n 'ajax_iwar_preview_email()', que utiliza 'is_admin()' como su \u00fanica comprobaci\u00f3n de autorizaci\u00f3n y permite a usuarios con bajos privilegios renderizar campos de combinaci\u00f3n de vista previa de correo electr\u00f3nico para una direcci\u00f3n de correo electr\u00f3nico arbitraria. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, generen y recuperen un enlace v\u00e1lido de restablecimiento de contrase\u00f1a para cualquier usuario de WordPress, incluidos los administradores, lo que permite la toma de control de la cuenta."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "security@wordfence.com"}