CVE-2026-17576
MediumCVSS 6.5Summary
The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13.9 due to insufficient escaping on array-key names supplied in the JSON request body before use in a SQL statement. This makes it possible for authenticated attackers with administrator-level access and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Risk Assessment
An attacker with administrator-level access can exfiltrate sensitive data from the database, potentially leading to a full system compromise.
Recommendation
Update the InfiniteWP Client plugin to a version later than 1.13.9.
Other vulnerabilities in InfiniteWP Client
See all- CVE-2026-15038Critical
The InfiniteWP Client WordPress plugin before version 1.13.6 improperly verifies the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations. This allows unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.
- CVE-2026-74011High
SQL Injection vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9.
Original NVD description (English source)
The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWP_MMB_Comment::get_comments() calls extract() on $args (which silently skips keys that are not valid PHP variable names) but a second foreach($args as $checkbox => $checkbox_val) processes every key, strips the 'iwp_get_comments_' prefix with str_replace(), wraps the remainder in single quotes, and imploded it into an IN(...) clause that is executed via $wpdb->get_results() with no prepare(). Because the request body is read from php://input and JSON-decoded, wp_magic_quotes() never touches the data, so quote characters in keys pass through unaltered. This makes it possible for authenticated attackers, with administrator-level access and above (an administrator can register their own public key via add_site using the plugin's WP-admin-generated activation_key and then issue signed get_comments requests), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.