EUVD-2026-63324
GHSA-6f7w-v766-m5fw
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Administrator credentials required (PR:H); network-accessible blind SQLi with scope change into database layer; no write or data-modification impact confirmed from blind read-only injection.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection.
This issue affects InfiniteWP Client: from n/a through 1.13.9.
AnalysisAI
Blind SQL Injection in the InfiniteWP Client WordPress plugin (revmakx) through version 1.13.9 allows high-privileged authenticated attackers to exfiltrate database contents via crafted network requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection reaches beyond the WordPress application boundary into the underlying database layer, enabling extraction of sensitive stored data including credentials and application records. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress administrator account (PR:H) - either a legitimate admin acting maliciously or an attacker who has already obtained admin credentials via a separate attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.6 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L reflects a network-exploitable blind SQL injection that nonetheless requires high privileges - consistent with a WordPress administrator role. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised WordPress administrator credentials - through phishing, credential stuffing, or a malicious insider - authenticates to the backend and submits a crafted HTTP request to an InfiniteWP Client administrative endpoint containing a blind SQL injection payload. Using time-based or boolean-based inference over a series of automated requests, the attacker incrementally extracts sensitive database contents, including WordPress user password hashes, stored API keys, and other application data. … |
| Remediation | Update InfiniteWP Client to the version released after 1.13.9 - no specific patched version number was confirmed in available intelligence data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/iwp-client/vulnerability/wordpress-infinitewp-client-plugin-1-13-9-sql-injection-vulnerability or the WordPress plugin repository at wordpress.org/plugins/iwp-client for the confirmed remediated release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all WordPress installations using InfiniteWP Client version 1.13.9 or earlier and restrict administrative access to the plugin to only essential personnel; review admin account activity logs for anomalous database queries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infinitewp Client
View allThe InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and includ
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in in
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in
The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today