InfusedWoo Pro Privilege Escalation Vulnerability via Missing Authorization in WordPress Plugin

A privilege escalation vulnerability has been identified in the InfusedWoo Pro plugin for WordPress, affecting all versions through 5.1.2. The issue arises from a lack of proper authorization, nonce verification, and capability checks in the 'iwar_save_recipe()' AJAX handler. This vulnerability allows unauthenticated attackers to create malicious automation recipes that trigger HTTP posts paired with auto-login actions. As a result, any unauthenticated visitor can access a crafted URL and receive authentication cookies for targeted user accounts, such as administrators, effectively bypassing authentication and escalating privileges.

Impact

Exploitation of this vulnerability allows for complete authentication bypass and privilege escalation, enabling unauthorized users to gain access to elevated rights on the WordPress site.

Remediation

Users are advised to update the InfusedWoo Pro plugin to version 5.1.3 or a newer patched version.