CVE-2026-7842: Infility Global WordPress Plugin SQL Injection Vulnerability

Technical summary

CVE-2026-7842 is a time-based blind SQL injection vulnerability affecting the Infility Global WordPress plugin before version 2.15.20. The vulnerability exists in three admin page callbacks: import_list(), url_detail(), and file_detail(). These functions accept orderby and order parameters that are directly incorporated into SQL queries without sanitization or validation. An authenticated attacker with Editor-level permissions or higher can craft malicious parameter values to execute arbitrary SQL commands. The ImportData module must be enabled for exploitation to occur. The attack is blind, meaning the attacker cannot directly observe query results but can infer database contents through response timing variations.

Business impact

An Editor-level WordPress user—such as a content contributor—could access sensitive database information including customer data, user credentials, configuration details, or other confidential records stored in the WordPress installation. Because the vulnerability enables data exfiltration without modification, it poses a confidentiality risk that could lead to regulatory violations (GDPR, CCPA), reputational damage, or competitive harm. The attack requires existing WordPress access, limiting the immediate risk surface, but organizations with permissive Editor-level role assignments face higher exposure.

Affected systems

WordPress installations using the Infility Global plugin version 2.15.19 and earlier are affected. The vulnerability is only exploitable if the ImportData module has been explicitly enabled through the plugin's module toggle settings. Organizations running version 2.15.20 or later are not affected. Multisite WordPress deployments with Editor-level users across multiple sites increase exposure.

Exploitability

Exploitation requires two preconditions: the attacker must already possess a valid WordPress account with at least Editor-level permissions, and the ImportData module must be enabled. No user interaction is required beyond the initial account access. Once these conditions are met, exploitation is straightforward—an attacker can systematically extract data through time-based blind SQL injection by observing response delays. The attack is not currently listed in CISA's Known Exploited Vulnerabilities catalog, indicating no public active exploitation at the time of publication.

Remediation

Update the Infility Global plugin to version 2.15.20 or later immediately. Organizations should verify the ImportData module status during and after the update to ensure it remains enabled only if operationally necessary. Review WordPress user roles and revoke unnecessary Editor-level permissions to reduce the attack surface. Consider implementing database-level access controls and monitoring for suspicious query patterns.

Patch guidance

Apply version 2.15.20 of the Infility Global plugin as soon as feasible. The patch addresses the input sanitization and validation deficiency in the orderby and order parameters. Standard WordPress plugin update procedures apply: back up the installation first, test in a staging environment if possible, then deploy to production. Verify the ImportData module functionality post-update to ensure no operational disruption.

Detection guidance

Monitor WordPress database logs for unusual SQL query patterns, particularly those containing WHERE clauses with timing delays or SLEEP/BENCHMARK functions in the context of import_list(), url_detail(), or file_detail() requests. Audit WordPress user accounts with Editor-level access and track login activity for unusual or unauthorized sessions. Enable WordPress security logging if available through plugins or server-level tools. Watch for repeated requests to admin pages containing the vulnerable parameters with varying payloads, which would indicate exploitation attempts.

Why prioritize this

Although rated MEDIUM severity (CVSS 6.8), this vulnerability warrants prompt attention because it enables unauthorized access to sensitive database contents from within the application. The requirement for pre-existing Editor-level access limits immediate exploitability, but organizations with loose role management or shared credentials face elevated risk. The lack of public exploitation to date suggests a window of opportunity to patch before threat actors develop weaponized tools. Prioritize environments where the ImportData module is enabled and Editor-level access is widely distributed.

Risk score, explained

CVSS 3.1 score of 6.8 (MEDIUM) reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), high privilege requirement (PR:H) reducing exploitability, and changed scope (S:C) enabling lateral impact. Confidentiality is High (C:H) because the attacker can extract arbitrary database contents, but Integrity and Availability are unaffected (I:N, A:N), capping the overall severity. The privilege barrier and module-enablement requirement prevent a higher rating despite the data exfiltration risk.

Frequently asked questions