Infility Global CVE-2026-10734

No authentication is required to inject the payload - the /cf7_record log endpoint accepts unauthenticated POST requests from any network-accessible client, and no non-default configuration is needed to expose this endpoint on a standard Infility Global installation through version 2.15.21. Payload execution requires that at least one authenticated WordPress user (Subscriber level or above) visit the /cf7_records viewer page after injection; without this victim-side page visit, the stored script remains dormant. Exploitation is bounded by two realistic constraints: the target WordPress site must have the Infility Global plugin installed and active, and the /cf7_records viewer must be reachable by at least one authenticated user. There is no requirement for specific PHP settings, non-default WordPress configurations, or prior attacker authentication.

The CVSS 7.2 score is driven primarily by the changed-scope vector component (S:C), which accurately captures that an unauthenticated attacker's payload crosses into the security context of authenticated user sessions - a meaningful escalation beyond server-side impact alone. In practical terms, even a mid-sized municipal IT team in mielec running a public-facing WordPress site with this plugin should treat this as urgent, because any Subscriber-level user visiting the records page becomes a vector for session hijacking or privilege escalation targeting higher-privileged accounts. The provided CVSS vector lists UI:N, which appears to represent the attacker's perspective on the injection phase; the independent assessment below reflects that victim interaction (visiting the records page) is required for payload execution, which somewhat moderates real-world exploitability compared to the vendor score. No EPSS score is available in the provided data, and the absence of a CISA KEV listing suggests no confirmed mass exploitation. No POC has been identified in available references. The primary realistic risk is administrative account compromise if the payload is crafted to harvest session cookies from WordPress admins who routinely access the records viewer.

An unauthenticated attacker submits a crafted HTTP POST request to the publicly accessible /cf7_record log endpoint containing a JavaScript payload embedded in a log field - for example, a script that exfiltrates document.cookie to an attacker-controlled server. The payload is stored in the plugin's records database without sanitization. When any authenticated WordPress user at Subscriber level or above subsequently navigates to the /cf7_records viewer page, the injected script executes in their browser, enabling session cookie theft, account takeover, or redirection to attacker-controlled content - particularly impactful if an administrator visits the page.