What is the CVSS score of CVE-2026-8685?

CVE-2026-8685 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Infility Global CVE-2026-8685

EUVD-2026-31020 MEDIUM

SQL Injection (CWE-89)

2026-05-20 Wordfence

GHSA-9vr2-54wv-26g5

WordPress SQLi

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:32 vuln.today

DescriptionCVE.org

The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16. This is due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query within the show_control_data::post_list() function, which is registered as an admin menu page with only the 'read' capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL Injection in the Infility Global WordPress plugin (all versions through 2.15.16) allows authenticated attackers holding only a Subscriber-level account to append arbitrary SQL to existing database queries and extract sensitive information. The vulnerability originates in the show_control_data::post_list() function, which is registered as an admin menu page gated only by the 'read' capability - the lowest WordPress capability tier. With CVSS C:H and no integrity or availability impact, the primary real-world risk is wholesale database exfiltration on any site with open user registration. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

CWE-89 (Improper Neutralization of Special Elements used in a SQL Command) describes the root cause: the plugin's show_control_data::post_list() function incorporates the user-supplied 'orderby' and 'order' HTTP parameters directly into a SQL query without sufficient escaping or parameterized preparation. The vulnerable code is identifiable at lines 34, 74, 78, and 84 of widgets/show-control-data/show-control-data.php in the plugin's WordPress.org repository trunk. Because WordPress's ORDER BY clause cannot use prepared statement placeholders for column names, plugins must whitelist valid values manually - the absence of this whitelist is the specific technical failure. The affected software is identified by CPE cpe:2.3:a:infility:infility_global:*:*:*:*:*:*:*:*, covering all known versions. The function is callable by any WordPress user possessing the 'read' capability, which is assigned to all registered users including the default Subscriber role.

RemediationAI

No vendor-released patched version has been identified at time of analysis - the provided references link to current trunk source code on the WordPress plugin repository without indicating a fixed release tag. Site administrators running Infility Global ≤ 2.15.16 should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1caeb5e0-9e4e-4c9e-a6e4-881fb81dc5f2 for patch availability. As an immediate compensating control, deactivate and remove the plugin if it is not operationally required, which fully eliminates the attack surface with no functional trade-off. If the plugin must remain active, disable open user registration (Settings > General > Membership in WordPress) to prevent untrusted Subscriber account creation, noting this will block new user self-registration entirely. A web application firewall rule blocking SQL metacharacters (quotes, comment sequences, UNION/SELECT keywords) in the 'orderby' and 'order' query parameters can reduce exploitation risk but may generate false positives if legitimate sort interactions use these parameters. Restricting database user privileges to only the tables and operations required by WordPress can limit the scope of data exposed if exploitation occurs.