Infility Global CVE-2026-7842

Two specific conditions must both be met for exploitation. First, the attacker must be authenticated to the WordPress installation with an Editor role or higher (confirmed by CVSS PR:H); unauthenticated or Subscriber/Contributor-level access is insufficient. Second, the ImportData module within the Infility Global plugin must be explicitly enabled by a site administrator through the plugin's module toggle page - this is a non-default opt-in configuration, and the vulnerable admin callbacks are inactive when the module is disabled. Exploitation is further limited to the WordPress admin panel context, meaning the attack path traverses the admin HTTP interface rather than any public-facing endpoint. What limits exploitation: the Editor+ authentication requirement prevents anonymous or low-privilege exploitation; the module toggle creates a non-default configuration gate; time-based blind injection requires patience and iterative requests compared to error-based or UNION-based techniques, but a public POC mitigates this complexity barrier.

The CVSS 3.1 base score of 6.8 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N reflects a network-exploitable, low-complexity injection requiring high privileges (Editor+). The Scope:Changed designation elevates the score despite PR:H, capturing that successful exploitation yields confidentiality impact across the entire database. Two concrete prerequisites meaningfully constrain real-world risk: the attacker must hold an Editor-level (or higher) WordPress account, and the ImportData module must be explicitly enabled by a site administrator - it is not active by default. A publicly available POC (WPScan) lowers the exploitation barrier for any attacker who already meets those prerequisites, but no CISA KEV listing indicates confirmed mass or widespread exploitation. EPSS data was not provided; exploitation probability is assessed as moderate given PR:H gating and the non-default module requirement. The practical threat is concentrated at sites where an insider threat or compromised Editor account intersects with the ImportData module being active, at which point full database read access - including hashed credentials, PII, and configuration secrets - becomes achievable.

An attacker who has compromised or socially engineered an Editor-level WordPress account on a site running a vulnerable Infility Global version with the ImportData module enabled sends a crafted HTTP POST to one of the affected admin callbacks with a malicious orderby value containing a time-based SQL expression (e.g., IF(1=1,SLEEP(5),0)). By measuring server response latency across repeated requests, the attacker iteratively extracts data bit-by-bit from WordPress tables - including wp_users password hashes, email addresses, and stored API keys. A publicly available POC lowers the technical barrier, making this a realistic scenario for any attacker who has obtained Editor credentials.