EUVD-2026-38416
GHSA-jgxx-4fc8-ff8f
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
PR:H confirmed by Editor+ requirement; S:C reflects database-wide read beyond plugin scope; no write or availability impact identified from description.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.
AnalysisAI
Time-based blind SQL injection in the Infility Global WordPress plugin (versions before 2.15.20) enables authenticated attackers holding Editor-level access or higher to extract arbitrary data from the WordPress database. The unsanitized orderby and order parameters in three admin callbacks - import_list(), url_detail(), and file_detail() - are passed directly into SQL queries without validation or parameterization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be met for exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.8 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N reflects a network-exploitable, low-complexity injection requiring high privileges (Editor+). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised or socially engineered an Editor-level WordPress account on a site running a vulnerable Infility Global version with the ImportData module enabled sends a crafted HTTP POST to one of the affected admin callbacks with a malicious `orderby` value containing a time-based SQL expression (e.g., `IF(1=1,SLEEP(5),0)`). By measuring server response latency across repeated requests, the attacker iteratively extracts data bit-by-bit from WordPress tables - including `wp_users` password hashes, email addresses, and stored API keys. … |
| Remediation | Upgrade the Infility Global WordPress plugin to version 2.15.20 or later, which contains the vendor-released patch resolving the unsanitized ORDER BY injection. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today