{"api_version":"1","generated_at":"2026-05-14T11:44:08+00:00","cve":"CVE-2026-6514","urls":{"html":"https://cve.report/CVE-2026-6514","api":"https://cve.report/api/cve/CVE-2026-6514.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-6514","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-6514"},"summary":{"title":"InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter","description":"The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.","state":"PUBLISHED","assigner":"Wordfence","published_at":"2026-05-14 09:16:28","updated_at":"2026-05-14 09:16:28"},"problem_types":["CWE-918","CWE-918 CWE-918 Server-Side Request Forgery (SSRF)"],"metrics":[{"version":"3.1","source":"security@wordfence.com","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://downloads.infusedwoo.com/updater/iw5.php?changelog","name":"https://downloads.infusedwoo.com/updater/iw5.php?changelog","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b75e61-e7f8-41cc-ab4f-e6ca42d68308?source=cve","name":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b75e61-e7f8-41cc-ab4f-e6ca42d68308?source=cve","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6514","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6514","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Infused Addons","product":"InfusedWoo Pro","version":"affected 5.1.2 semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-03-11T00:00:00.000Z","lang":"en","value":"Discovered"},{"source":"CNA","time":"2026-04-21T15:57:25.000Z","lang":"en","value":"Vendor Notified"},{"source":"CNA","time":"2026-05-13T19:52:06.000Z","lang":"en","value":"Disclosed"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Osvaldo Noe Gonzalez Del Rio","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"InfusedWoo Pro","vendor":"Infused Addons","versions":[{"lessThanOrEqual":"5.1.2","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Osvaldo Noe Gonzalez Del Rio"}],"descriptions":[{"lang":"en","value":"The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-05-14T08:24:25.664Z","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence"},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b75e61-e7f8-41cc-ab4f-e6ca42d68308?source=cve"},{"url":"https://downloads.infusedwoo.com/updater/iw5.php?changelog"}],"timeline":[{"lang":"en","time":"2026-03-11T00:00:00.000Z","value":"Discovered"},{"lang":"en","time":"2026-04-21T15:57:25.000Z","value":"Vendor Notified"},{"lang":"en","time":"2026-05-13T19:52:06.000Z","value":"Disclosed"}],"title":"InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter"}},"cveMetadata":{"assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","assignerShortName":"Wordfence","cveId":"CVE-2026-6514","datePublished":"2026-05-14T08:24:25.664Z","dateReserved":"2026-04-17T13:28:36.932Z","dateUpdated":"2026-05-14T08:24:25.664Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-14 09:16:28","lastModifiedDate":"2026-05-14 09:16:28","problem_types":["CWE-918","CWE-918 CWE-918 Server-Side Request Forgery (SSRF)"],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"6514","Ordinal":"1","Title":"InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read vi","CVE":"CVE-2026-6514","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"6514","Ordinal":"1","NoteData":"The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.","Type":"Description","Title":"InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read vi"}]}}}