What is the CVSS score of CVE-2026-8163?

CVE-2026-8163 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Infility Global are affected by CVE-2026-8163?

A vulnerability in the Infility Global WordPress plugin allows low-privilege user accounts to access and modify sensitive database information on affected websites.. A patch is available.

Is there a public PoC exploit available for CVE-2026-8163?

Yes, a public proof-of-concept exploit is available for CVE-2026-8163. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-8163?

Within 24 hours: Inventory all WordPress instances using Infility Global plugin and review user registration logs for suspicious subscriber accounts created recently. Within 7 days: Update Infility Global plugin to version 2.15.19 or later on all affected installations. Within 30 days: Audit database user permissions to enforce principle of least privilege and implement database query logging.

Infility Global CVE-2026-8163

EUVD-2026-38417 HIGH

2026-06-23 WPScan

GHSA-2hm5-4cpf-66vx

SQLi WordPress Infility Global

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint, no user interaction, Subscriber account required so PR:L, and SQLi over the full WordPress database yields high C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 13:22 vuln.today

CVSS changed

Jun 23, 2026 - 13:22 NVD

8.8 (HIGH)

Patch available

Jun 23, 2026 - 08:16 EUVD

CVE Published

Jun 23, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 23, 2026 - 06:00 cve.org

HIGH 8.8

DescriptionCVE.org

The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.

Articles & Coverage 1

News 3 New WordPress Vulnerabilities - 3 High Severity, All With POC Jun 24, 2026

AnalysisAI

SQL injection in the Infility Global WordPress plugin before 2.15.19 allows authenticated users with Subscriber-level access or higher to inject arbitrary SQL via unsanitized parameters. Publicly available exploit code exists (WPScan), and a vendor patch has been released, raising the practical risk on sites that allow open user registration. No CISA KEV listing at time of analysis.

Technical ContextAI

The vulnerability resides in the Infility Global plugin for WordPress (CPE cpe:2.3:a:unknown:infility_global), which extends the WordPress platform's PHP/MySQL stack. The root cause is classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the plugin interpolates request parameters into SQL statements without using $wpdb->prepare() placeholders or properly escaping inputs with esc_sql(). Because WordPress's Subscriber role is the lowest authenticated tier and is automatically granted to any user who registers when open registration is enabled, the authentication barrier is effectively trivial on many production sites.

RemediationAI

Vendor-released patch: upgrade the Infility Global plugin to version 2.15.19 or later via the WordPress plugin updater, referencing the WPScan advisory at https://wpscan.com/vulnerability/e471516a-6f43-4a89-8486-7a638845e197/ for confirmation. Where immediate patching is not possible, disable the Infility Global plugin until the upgrade can be applied (this removes any features the plugin provides), and as a temporary compensating control disable open user registration in WordPress (Settings → General → Membership) to prevent untrusted users from obtaining the Subscriber role required for exploitation - the trade-off is that legitimate self-service signup is blocked. Additionally consider placing a WAF rule in front of the site to block SQL meta-characters in the plugin's request parameters, accepting the usual WAF false-positive risk, and audit existing low-privilege accounts for unexpected creations.