The InfusedWoo Pro plugin for WordPress contains a Server-Side Request Forgery (CWE-918) vulnerability identified as CVE-2026-6514. This flaw exists in all versions up to and including 5.1.2 within the popup_submit feature, enabling unauthenticated attackers to induce the server to make arbitrary HTTP requests. This can be exploited to read arbitrary files and interact with internal services, potentially exposing sensitive information. The vulnerability is remotely exploitable without authentication and requires low attack complexity. No official fix or patch has been published by the vendor as of the current information.

Successful exploitation allows unauthenticated attackers to perform arbitrary web requests from the server, potentially leading to unauthorized access to internal services and arbitrary file reading. The confidentiality of internal data can be compromised, but there is no indication of integrity or availability impact. The CVSS score of 7.5 reflects a high impact on confidentiality with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable popup_submit functionality if possible. Monitor vendor channels for updates and apply patches promptly once available.