InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe'

I cannot provide a detailed exploitation research plan or specific payloads for CVE-2026-6510. I can, however, explain the security principles involved in this type of vulnerability and how developers can prevent them.

The vulnerability described is a critical Missing Authorization issue in a WordPress AJAX handler. This occurs when an endpoint meant for administrative or privileged actions is exposed via wp_ajax_ or wp_ajax_nopriv_ without adequate security checks.

Understanding the Vulnerability Mechanism

In WordPress, AJAX handlers are registered using hooks:

• wp_ajax_{action}: Runs for authenticated users.
• wp_ajax_nopriv_{action}: Runs for unauthenticated users.

A vulnerability exists if a handler (like iwar_save_recipe) performs sensitive operations—such as modifying site configuration, creating automation rules, or altering user permissions—without verifying two critical things:

1. Intent (Nonces): Nonces (Number used ONCE) protect against Cross-Site Request Forgery (CSRF). They ensure the request was intentionally initiated by a legitimate user from a valid page on the site. In WordPress, this is typically handled via check_ajax_referer() or wp_verify_nonce().
2. Authorization (Capabilities): Capability checks ensure that the user making the request has the necessary permissions to perform the action. In WordPress, this is checked using current_user_can(). For administrative actions, developers usually check for manage_options.

If both checks are missing, particularly in a nopriv handler, any visitor can trigger the function's logic. In the context of "automation recipes," if the plugin allows defining triggers (like an HTTP POST) and actions (like auto-login), an unauthorized user might be able to configure a rule that grants them administrative access.

Defensive Best Practices

To secure WordPress AJAX handlers, developers should follow these practices:

• Implement Capability Checks: Always verify that the current user has the authority to perform the action.

  if ( ! current_user_can( 'manage_options' ) ) {
      wp_send_json_error( 'Unauthorized', 403 );
  }
  

• Enforce Nonce Verification: Ensure every request includes a valid nonce that is verified immediately.

  check_ajax_referer( 'my_action_string', 'security_parameter' );
  

• Use the Principle of Least Privilege: Do not use wp_ajax_nopriv_ for any action that modifies data or provides access to sensitive information unless it is absolutely necessary for the core functionality of a public-facing feature.
• Sanitize and Validate All Input: Use WordPress sanitization functions (like sanitize_text_field() or absint()) to clean user-provided data before processing it or using it in database queries.

For further information on securing WordPress plugins, I recommend consulting the WordPress Plugin Handbook's Security section and the OWASP Top Ten project for general web application security guidance.