InfiniteWP Client CVE-2026-17576

Requires an authenticated WordPress user with administrator-level access (or higher) on the site running InfiniteWP Client <=1.13.9. The attacker must register their own public key through the plugin's add_site action using the plugin's WP-admin-generated activation_key, then issue cryptographically signed get_comments requests whose JSON request body (read via php://input) carries crafted array-key names. Exploitation is limited by this high privilege bar - an administrator already possessing broad site and database access - which sharply reduces practical impact despite the network attack vector.

This is a genuine SQL injection (CWE-89) confirmed by Wordfence with a source-code-level root cause in IWP_MMB_Comment::get_comments(), but the real-world risk is materially lower than the 6.5 CVSS or a bare 'SQLi' label would suggest. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores privileges as PR:L, yet the description explicitly states exploitation requires 'administrator-level access and above' - an administrator registers their own public key via add_site using the WP-admin activation key, then issues signed get_comments requests. That is a PR:H-class prerequisite, so the PR:L scoring is arguably generous (see confidence_notes); a WordPress administrator already has legitimate read access to the database via other means, so this injection grants little privilege the attacker does not already possess. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' Net: a valid but low-priority defense-in-depth issue, not an urgent unauthenticated threat despite AV:N.

An attacker who has already obtained WordPress administrator access registers their own public key through the plugin's add_site action using the WP-admin-generated activation key, then sends a signed get_comments request whose JSON body contains crafted array-key names with embedded single quotes. Because the body is read from php://input and JSON-decoded, wp_magic_quotes() never sanitizes it, so the injected SQL is imploded into an IN(...) clause and run via $wpdb->get_results() without prepare(), letting the attacker extract sensitive database contents. No public exploit code was identified at the time of analysis.