InfiniteWP Client EUVD-2026-63324

Exploitation requires a valid WordPress administrator account (PR:H) - either a legitimate admin acting maliciously or an attacker who has already obtained admin credentials via a separate attack. The InfiniteWP Client plugin must be installed and active on the target WordPress instance. The injection is network-reachable (AV:N) over standard HTTP/HTTPS with low attack complexity (AC:L), meaning no special network position, race condition, or chained vulnerability is required once credentials are in hand. Exploitation is strictly bounded by the high privilege requirement: unauthenticated users, subscribers, editors, and authors cannot exploit this vulnerability. Sites enforcing MFA on administrator accounts, restricting wp-admin by IP, or running web application firewalls with SQL injection rulesets significantly reduce realistic exploitation likelihood beyond what the raw CVSS score implies.

The CVSS 3.1 score of 7.6 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L reflects a network-exploitable blind SQL injection that nonetheless requires high privileges - consistent with a WordPress administrator role. The scope change (S:C) elevates the score meaningfully, indicating that the SQL injection can affect components beyond the vulnerable plugin itself, likely the shared database server or other hosted applications. EPSS probability data was not provided, preventing quantitative exploitation likelihood estimation. No KEV listing and no confirmed public POC code reduce immediate urgency compared to actively exploited issues. The PR:H requirement is the dominant risk-limiting factor: exploitation is contingent on a compromised or malicious administrator account, making sites with strong admin account hygiene and MFA significantly more resilient. The primary realistic threat model is post-credential-compromise lateral movement or insider threat rather than opportunistic internet scanning.

An attacker who has compromised WordPress administrator credentials - through phishing, credential stuffing, or a malicious insider - authenticates to the backend and submits a crafted HTTP request to an InfiniteWP Client administrative endpoint containing a blind SQL injection payload. Using time-based or boolean-based inference over a series of automated requests, the attacker incrementally extracts sensitive database contents, including WordPress user password hashes, stored API keys, and other application data. No public exploit code has been identified at time of analysis, meaning exploitation currently requires manual or custom tooling against the blind injection vector.