Is CVE-2026-6514 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6514 being exploited in the wild.

How severe is CVE-2026-6514?

High severity, with a CVSS score of 7.5, published 14 May 2026.

Which products and versions are affected?

InfusedWoo InfusedWoo Pro up to, and including, 5.1.2.

Is there a fix for CVE-2026-6514?

A patch was published on 2026-04-22: Fixed in version 5.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6514 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6514?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6514: InfusedWoo Pro arbitrary file read in popup_submit

CVE-2026-6514 · Severity: high · CVSS 7.5 · Published 2026-05-14

InfusedWoo Pro is a WordPress plugin used to integrate WooCommerce stores with the Keap (formerly Infusionsoft) CRM platform. A security vulnerability in the plugin's opt-in popup feature allows unauthenticated attackers to read sensitive files from the server or interact with internal network services. This could lead to the exposure of configuration files, credentials, or other private data, potentially compromising the entire website and its connected services.

Quick answers

Is CVE-2026-6514 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6514 being exploited in the wild.
How severe is CVE-2026-6514?: High severity, with a CVSS score of 7.5, published 14 May 2026.
Which products and versions are affected?: InfusedWoo InfusedWoo Pro up to, and including, 5.1.2.
Is there a fix for CVE-2026-6514?: A patch was published on 2026-04-22: Fixed in version 5.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6514 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6514?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read and Server-Side Request Forgery (SSRF) in versions up to and including 5.1.2. The vulnerability exists within the 'popup_submit' endpoint due to insufficient input validation and authorization checks. An unauthenticated remote attacker can exploit this by sending crafted web requests to the application, forcing it to retrieve files from the local file system or make requests to internal network locations. This can be used to bypass firewalls to query or modify information from internal services. The issue was addressed in version 5.1.3 through improved authorization, input validation, and the implementation of rate limiting.

Affected products

InfusedWoo InfusedWoo Pro up to, and including, 5.1.2

Timeline

2026-04-22: patched: Fixed in version 5.1.3
2026-05-14: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.