EUVD-2026-38417
GHSA-2hm5-4cpf-66vx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress endpoint, no user interaction, Subscriber account required so PR:L, and SQLi over the full WordPress database yields high C/I/A.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.
AnalysisAI
SQL injection in the Infility Global WordPress plugin before 2.15.19 allows authenticated users with Subscriber-level access or higher to inject arbitrary SQL via unsanitized parameters. Publicly available exploit code exists (WPScan), and a vendor patch has been released, raising the practical risk on sites that allow open user registration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Infility Global plugin to be installed and active at a version below 2.15.19 on the target WordPress site, and the attacker must hold a valid account at Subscriber role or above (PR:L in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) reflects network reachability, low complexity, low-privilege authentication, no user interaction, and full CIA impact - consistent with a database-extracting SQLi on an internet-facing CMS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free Subscriber-level account on a target WordPress site running Infility Global below 2.15.19 (or uses any existing low-privilege credential), then sends a crafted HTTP request to the vulnerable plugin endpoint with SQL payloads injected into the unsanitized parameter. Using the publicly available WPScan exploit technique, the attacker extracts the wp_users table including password hashes and secret keys, then escalates by cracking the administrator hash or forging authentication cookies. |
| Remediation | Vendor-released patch: upgrade the Infility Global plugin to version 2.15.19 or later via the WordPress plugin updater, referencing the WPScan advisory at https://wpscan.com/vulnerability/e471516a-6f43-4a89-8486-7a638845e197/ for confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress instances using Infility Global plugin and review user registration logs for suspicious subscriber accounts created recently. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today