The InfusedWoo Pro plugin for WordPress suffers from a missing authorization check (CWE-862) in all versions up to 5.1.2. This flaw allows unauthenticated attackers to perform unauthorized destructive actions such as permanently deleting arbitrary posts, pages, products, or orders, mass-deleting comments, and altering post statuses. The vulnerability is remotely exploitable without any privileges or user interaction, reflected by a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation leads to complete compromise of content integrity and confidentiality within the affected WordPress site. Attackers can delete critical content and orders, disrupt site operations, and manipulate post statuses without authentication. This can result in significant operational disruption and data loss for site owners.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and consider disabling or removing InfusedWoo Pro to prevent exploitation. Monitor for updates from the vendor and apply patches promptly once available.