The InfusedWoo Pro plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the ajax_iwar_preview_email() function. The function incorrectly uses is_admin() as its only authorization check, which does not sufficiently restrict access. As a result, low-privilege authenticated users can render email preview merge fields for arbitrary email addresses and generate valid password reset links for any user account, including administrators. This vulnerability enables privilege escalation via account takeover. It affects all versions up to and including 5.1.17. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An authenticated attacker with subscriber-level privileges or higher can exploit this vulnerability to generate password reset links for any user, including administrators. This enables account takeover and full compromise of the WordPress site. The impact includes complete loss of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin or disable it if possible. Monitor for updates from the vendor and apply official patches once released.