CVE-2026-19892 Overview
The InfusedWoo Pro plugin for WordPress contains a missing authorization vulnerability [CWE-862] in all versions up to and including 5.1.17. The ajax_iwar_preview_email() function relies on is_admin() as its only authorization check, which does not verify user capabilities. Authenticated attackers with subscriber-level access can render email preview merge fields for arbitrary email addresses. This behavior allows attackers to generate and retrieve valid WordPress password reset links for any account, including administrators, leading to full account takeover.
Critical Impact
A subscriber-level account can obtain a valid administrator password reset link and take over the WordPress site.
Affected Products
- InfusedWoo Pro plugin for WordPress
- Versions up to and including 5.1.17
- WordPress sites with authenticated subscriber registration enabled
Discovery Timeline
- 2026-08-25 - CVE-2026-19892 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-19892
Vulnerability Analysis
The vulnerability resides in the ajax_iwar_preview_email() AJAX handler exposed by the InfusedWoo Pro plugin. The handler is intended to render a preview of transactional emails with merge fields resolved for a target user. Because the plugin performs no capability check, any authenticated user can invoke the handler.
The is_admin() WordPress function used by the handler only confirms that the request targets an admin-area endpoint. It does not verify that the caller holds administrative privileges. As a result, low-privilege users reach code paths that generate password reset tokens tied to any specified email address.
When the preview renders merge fields, it exposes the resulting password reset URL back to the caller. An attacker submits the administrator email, receives the reset link, and completes password reset to gain full site control.
Root Cause
The root cause is a missing capability check [CWE-862]. The plugin conflates request context (is_admin()) with user authorization (current_user_can()). WordPress AJAX endpoints registered via wp_ajax_* inherit the admin-area context for authenticated users, so is_admin() returns true for every logged-in caller, including subscribers.
Attack Vector
Exploitation requires an authenticated WordPress account with subscriber privileges or higher. On sites permitting open registration, an attacker creates an account, authenticates, and issues an AJAX request to wp-admin/admin-ajax.php invoking the iwar_preview_email action with the target administrator email address. The response contains the merge-field-rendered preview, including the password reset link. The attacker follows the link, sets a new password, and authenticates as administrator.
Refer to the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-19892
Indicators of Compromise
- Unexpected POST requests to wp-admin/admin-ajax.php with the action=iwar_preview_email parameter from non-administrative user sessions.
- Password reset events for administrator accounts that were not initiated from the standard wp-login.php?action=lostpassword flow.
- New administrator logins from unfamiliar IP addresses shortly after subscriber account creation.
- Recent subscriber registrations followed by privilege changes or plugin/theme modifications.
Detection Strategies
- Inspect web server access logs for admin-ajax.php calls containing iwar_preview_email originating from low-privilege session cookies.
- Correlate WordPress user metadata changes (user_pass, session_tokens) with prior AJAX activity from the same session.
- Alert on password reset link generation events not preceded by a wp_lostpassword_url request from the login page.
Monitoring Recommendations
- Enable WordPress audit logging for authentication, password reset, and role change events.
- Forward WordPress and web server logs to a centralized SIEM for correlation across user identity and HTTP activity.
- Monitor for administrator authentication from IP addresses that recently held subscriber sessions.
How to Mitigate CVE-2026-19892
Immediate Actions Required
- Update the InfusedWoo Pro plugin to a version later than 5.1.17 once a patched release is available from the vendor.
- Audit all administrator accounts for unexpected password changes, email changes, or new sessions.
- Rotate administrator credentials and invalidate active sessions using wp_destroy_all_sessions for privileged users.
- Review recent user registrations and remove unrecognized subscriber accounts.
Patch Information
Consult the InfusedWoo Changelog Update for the fixed release and upgrade instructions. Apply the vendor patch across all WordPress instances running InfusedWoo Pro.
Workarounds
- Disable the InfusedWoo Pro plugin until the patched version is deployed.
- Disable open user registration by unchecking Anyone can register under Settings > General to raise the barrier to authenticated exploitation.
- Restrict access to wp-admin/admin-ajax.php from untrusted networks using a web application firewall rule that blocks the iwar_preview_email action for non-administrator sessions.
- Enforce multi-factor authentication on administrator accounts to reduce the impact of a stolen password reset link.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
