CVE-2026-6506 is a missing authorization vulnerability (CWE-862) in the InfusedWoo Pro WordPress plugin. The issue is in the infusedwoo_gdpr_upddata() function, which does not verify user capabilities or restrict which user meta keys can be updated. As a result, authenticated users with subscriber-level access or above can escalate their privileges by updating their wp_capabilities meta key to gain Administrator rights. This vulnerability affects all versions up to and including 5.1.2 and has a CVSS 3.1 base score of 8.8, indicating a high-severity remote exploit with no user interaction required.

An attacker with subscriber-level access or higher can exploit this vulnerability to escalate their privileges to Administrator within the WordPress site. This grants full control over the site, including the ability to modify content, install plugins, and manage users, severely impacting confidentiality, integrity, and availability of the affected system.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to trusted users only and monitor for suspicious privilege changes. Consider disabling or removing the InfusedWoo Pro plugin if possible to reduce risk.