Infused Addons CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Infused Addons CVE published 2026-08-25

CVE-2026-19892

The InfusedWoo Pro plugin for WordPress has a privilege escalation vulnerability via account takeover in versions up to 5.1.17. This is due to a missing capability check in the `ajax_iwar_preview_email()` function, allowing low-privilege users to render email preview merge fields for arbitrary email addresses. Authenticated attackers with subscriber-level access can generate and retrieve valid password re [truncated]