WordPress InfusedWoo Pro Unauthenticated Server-Side Request Forgery

The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Casky was already ahead

This CVE exploits attack patterns that Casky's 312matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The InfusedWoo Pro WordPress plugin contains a Server-Side Request Forgery (SSRF) vulnerability in its popup_submit functionality that allows unauthenticated attackers to make arbitrary web requests originating from the vulnerable server. This vulnerability, tracked as CVE-2026-6514 with a CVSS score of 7.5, affects all versions up to 5.1.2 and exposes WordPress sites to reconnaissance, lateral movement, and potential data exfiltration from internal services. Any organization running this popular e-commerce plugin without patching is at risk, as attackers can bypass network segmentation to probe internal infrastructure, query metadata services, or interact with local applications that should only be accessible within the network perimeter.

Casky's 312 matching security skills leverage Claude's extended reasoning to detect SSRF attack patterns mapped to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious indicators such as: unexpected outbound HTTP requests from the web application to internal IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x) or localhost services, unusual User-Agent patterns in logs originating from the popup_submit endpoint, and attempts to access cloud metadata endpoints (169.254.169.254). The platform's skill mappings help security teams recognize how attackers chain this SSRF weakness into multi-stage attacks—using initial reconnaissance to discover internal services, then escalating to credential harvesting from exposed APIs or configuration files, ultimately enabling deeper network compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

312 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-6514.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-6514

Casky has 312 skills that investigate the attack patterns behind CVE-2026-6514. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn