EUVD-2026-38416
GHSA-jgxx-4fc8-ff8f
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
PR:H confirmed by Editor+ requirement; S:C reflects database-wide read beyond plugin scope; no write or availability impact identified from description.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.
AnalysisAI
Time-based blind SQL injection in the Infility Global WordPress plugin (versions before 2.15.20) enables authenticated attackers holding Editor-level access or higher to extract arbitrary data from the WordPress database. The unsanitized orderby and order parameters in three admin callbacks - import_list(), url_detail(), and file_detail() - are passed directly into SQL queries without validation or parameterization. A publicly available proof-of-concept exploit exists per WPScan (EUVD-2026-38416), and the CVSS S:C designation confirms that impact extends beyond the plugin itself to the full underlying database; no confirmed active exploitation (CISA KEV) has been documented at time of analysis.
Technical ContextAI
The Infility Global WordPress plugin (CPE: cpe:2.3:a:unknown:infility_global:*:*:*:*:*:*:*:*, versions before 2.15.20) exposes three admin-side PHP callbacks - import_list(), url_detail(), and file_detail() - that accept user-supplied orderby and order parameters for sorting tabular data in the ImportData module. These parameters are interpolated directly into SQL ORDER BY clauses without whitelisting or parameterization. ORDER BY column references cannot be bound via prepared-statement placeholders in standard SQL, making explicit whitelisting the only safe approach; the plugin omits this entirely. The root cause aligns with CWE-89 (Improper Neutralization of Special Elements in SQL Commands) and CWE-20 (Improper Input Validation), though the source data lists CWE as N/A. The CVSS Scope:Changed metric reflects that exploitation reads data across the entire WordPress database - including tables managed by WordPress core and other plugins - not merely the plugin's own data.
RemediationAI
Upgrade the Infility Global WordPress plugin to version 2.15.20 or later, which contains the vendor-released patch resolving the unsanitized ORDER BY injection. The fix is documented at https://wpscan.com/vulnerability/210303c4-0964-4a01-ac8e-13d7c7f424a2/. If immediate upgrade is not feasible, disable the ImportData module via the plugin's module toggle page - this removes all three vulnerable callbacks (import_list(), url_detail(), file_detail()) from the active attack surface entirely; note that disabling the module will break any import-related administrator workflows relying on that feature. Additionally, audit all WordPress users with Editor-level access or higher and revoke unnecessary elevated roles, as this shrinks the pool of principals who could exploit the flaw. Enable database query logging and alert on anomalous time-delay patterns consistent with SLEEP()-based or conditional time-blind SQL payloads as a detection control.
More in Infility Global
View allSQL injection in the Infility Global WordPress plugin before 2.15.19 allows authenticated users with Subscriber-level ac
Stored Cross-Site Scripting in the Infility Global WordPress plugin (versions ≤ 2.15.21) allows unauthenticated remote a
SQL Injection in the Infility Global WordPress plugin (all versions through 2.15.16) allows authenticated attackers hold
The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in
Share
External POC / Exploit Code
Leaving vuln.today