InfusedWoo Pro Authorization Bypass Vulnerability Allowing Unauthenticated Arbitrary Post Deletion

A vulnerability exists in the InfusedWoo Pro plugin for WordPress, affecting all versions through 5.1.2. The issue stems from the plugin's failure to properly verify user authorization, enabling unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders. Additionally, this vulnerability allows for the mass deletion of comments on any post and the ability to change any post's status.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of posts, pages, products, or orders, mass deletion of comments, and unauthorized changes to post statuses.

Remediation

Users are advised to update the InfusedWoo Pro plugin to version 5.1.3 or a newer patched version.