Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the `ajax_iwar_preview_email()` function, which uses `is_admin()` as its only authorization check and allows low-privilege users to render email preview merge fields for an arbitrary email address. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate and retrieve a valid password reset link for any WordPress user, including administrators, enabling account takeover.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-19892 Privilege Escalation via Account Takeover in InfusedWoo Pro WordPress Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-19892
Post summary
The text announces CVE‑2026‑19892, describing it as a privilege escalation vulnerability via account takeover in the InfusedWoo Pro WordPress plugin, with no additional details on PoC, exploitation, or fixes.