Is CVE-2026-6512 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6512 being exploited in the wild.

How severe is CVE-2026-6512?

Critical severity, with a CVSS score of 9.1, published 14 May 2026.

Which products and versions are affected?

InfusedWoo InfusedWoo Pro up to, and including, 5.1.2.

Is there a fix for CVE-2026-6512?

A patch was published on 2026-04-22: Version 5.1.3 released with security hardening. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6512 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6512?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6512: InfusedWoo Pro authorization bypass in WordPress plugin

CVE-2026-6512 · Severity: critical · CVSS 9.1 · Published 2026-05-14

InfusedWoo Pro, a WordPress plugin used to integrate WooCommerce stores with the Keap (formerly Infusionsoft) CRM, contains a security flaw that allows unauthorized individuals to bypass security checks. An attacker can exploit this to permanently delete website content, including posts, pages, products, and customer orders. This could lead to significant data loss, disruption of business operations, and damage to the store's reputation.

Quick answers

Is CVE-2026-6512 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6512 being exploited in the wild.
How severe is CVE-2026-6512?: Critical severity, with a CVSS score of 9.1, published 14 May 2026.
Which products and versions are affected?: InfusedWoo InfusedWoo Pro up to, and including, 5.1.2.
Is there a fix for CVE-2026-6512?: A patch was published on 2026-04-22: Version 5.1.3 released with security hardening. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6512 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6512?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The InfusedWoo Pro plugin for WordPress fails to implement proper authorization checks on several administrative and automation endpoints. This vulnerability (CWE-862) allows unauthenticated remote attackers to perform sensitive actions such as permanently deleting arbitrary posts, pages, products, or orders, mass-deleting comments, and changing post statuses. The flaw stems from missing capability checks and insufficient validation of user permissions before executing these actions. The issue is addressed in version 5.1.3, which introduced hardening across the Automation Recipes area and other CRUD endpoints.

Affected products

InfusedWoo InfusedWoo Pro up to, and including, 5.1.2

Timeline

2026-04-22: patched: Version 5.1.3 released with security hardening.
2026-05-14: disclosed: Vulnerability published to the CVE list.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.