SQL Injection Vulnerability in InfiniteWP Client Plugin for WordPress

CVE-2026-17576

What is CVE-2026-17576?

The InfiniteWP Client plugin for WordPress is susceptible to SQL injection due to inadequate escaping of array-key names provided in the JSON request body. This vulnerability arises in versions up to and including 1.13.9, where authenticated attackers with administrator-level privileges can exploit the issue via the get_comments action. The exploitation allows attackers to append arbitrary SQL queries, leveraging the plugin's behavior of processing unsanitized keys after a JSON decode, thereby gaining unauthorized access to sensitive database information.

References