The InfusedWoo Pro plugin for WordPress contains a missing authorization vulnerability (CWE-862) in its iwar_save_recipe() AJAX handler due to absent nonce verification and capability checks. This allows unauthenticated attackers to create malicious automation recipes that pair an HTTP POST trigger with an auto-login action. Exploiting this, an attacker can visit a crafted URL and receive authentication cookies for any targeted user account, effectively bypassing authentication and escalating privileges to that user’s level. The vulnerability affects all versions up to and including 5.1.2 and has a CVSS 3.1 base score of 9.8, indicating critical severity.

Successful exploitation results in complete authentication bypass and privilege escalation to any user account, including administrators. This compromises confidentiality, integrity, and availability of the affected WordPress site, allowing attackers full control over the site’s functionality and data.

Patch status is not yet confirmed — no official fix or patch is currently available from the vendor. Users should monitor the vendor advisory for updates and apply any forthcoming official patches promptly. Until a patch is released, restrict access to the affected AJAX handler if possible and consider disabling the InfusedWoo Pro plugin to prevent exploitation.