Executive brief
InfusedWoo Pro is a WordPress plugin that integrates WooCommerce stores with the Keap CRM platform. A flaw in the email preview function allows any logged-in user with basic subscriber permissions to generate valid password reset links for administrator accounts, enabling complete account takeover and site compromise.
Technical details
The vulnerability exists in the `ajax_iwar_preview_email()` function, which relies solely on `is_admin()` for authorization—a check that returns true for any authenticated user in the WordPress admin area, not just administrators. This missing capability check allows subscribers and other low-privilege users to retrieve email preview merge fields containing password reset tokens for arbitrary user accounts. An authenticated attacker can exploit this via AJAX calls to extract valid password reset links for any user, including site administrators, leading to account takeover. The vulnerability affects versions up to and including 5.1.17, with patches available in version 5.1.18 and later.
Affected products
- InfusedWoo InfusedWoo Pro up to 5.1.17
Timeline
- 2026-08-25: disclosed
- 2026-08-15: patched: Security patch released in version 5.1.18