Authentication Bypass in InfiniteWP Client Plugin for WordPress by InfiniteWP
CVE-2026-15038
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 9 August 2026
Badges
What is CVE-2026-15038?
The InfiniteWP Client for WordPress contains a security flaw where the plugin fails to verify the connection state and the authenticity of requests at its remote management endpoint, particularly within WordPress Multisite setups. This oversight permits unauthenticated attackers to bind a malicious key to their account, enabling them to hijack administrator sessions and potentially take full control of the entire network. This vulnerability not only undermines user accounts but also opens the door to remote code execution on compromised systems.
Affected Version(s)
InfiniteWP Client 0 < 1.13.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.