SQL Injection Vulnerability in Infility Global WordPress Plugin
CVE-2026-7842
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 June 2026
Badges
What is CVE-2026-7842?
The Infility Global WordPress plugin prior to version 2.15.20 is susceptible to SQL injection due to improper sanitization and validation of input parameters in its admin page callbacks. This vulnerability allows authenticated users with Editor-level access or higher to manipulate SQL queries through the import_list(), url_detail(), and file_detail() functions, potentially leading to unauthorized access to sensitive data stored in the database. The risk is amplified if the ImportData module is enabled, creating an avenue for malicious actors to exploit this weakness.
Affected Version(s)
Infility Global 0 < 2.15.20
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.