Infility Global CVE-2026-8163

Exploitation requires the Infility Global plugin to be installed and active at a version below 2.15.19 on the target WordPress site, and the attacker must hold a valid account at Subscriber role or above (PR:L in the CVSS vector). On sites with open user registration enabled (the WordPress default when 'Anyone can register' is checked) this is effectively unauthenticated because any visitor can self-provision a Subscriber account; on sites with closed registration the attacker must first obtain or be granted any authenticated account. The attacker must reach the vulnerable plugin endpoint over the network (AV:N), no user interaction by another party is needed (UI:N), and attack complexity is low (AC:L) with no special platform, language, or non-default plugin configuration documented.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) reflects network reachability, low complexity, low-privilege authentication, no user interaction, and full CIA impact - consistent with a database-extracting SQLi on an internet-facing CMS. EPSS and KEV status are not provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild use cannot be asserted. The presence of a public WPScan exploit reference materially raises real-world risk, especially on sites permitting open subscriber registration, while the PR:L requirement somewhat tempers exposure on sites with closed registration. Overall this is a genuine priority for any WordPress site running Infility Global, not a high-CVSS-but-low-real-risk artifact.

An attacker registers a free Subscriber-level account on a target WordPress site running Infility Global below 2.15.19 (or uses any existing low-privilege credential), then sends a crafted HTTP request to the vulnerable plugin endpoint with SQL payloads injected into the unsanitized parameter. Using the publicly available WPScan exploit technique, the attacker extracts the wp_users table including password hashes and secret keys, then escalates by cracking the administrator hash or forging authentication cookies.