CVE-2026-74011

HighCVSS 7.6

Published: 20/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

SQL Injection vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9.

Risk Assessment

An attacker could exploit this vulnerability to gain unauthorized access to data in the database, potentially leading to confidentiality and integrity breaches.

Recommendation

It is recommended to upgrade InfiniteWP Client to a version later than 1.13.9, which includes the fix. Also, restrict access to the application and monitor database logs.

Other vulnerabilities in InfiniteWP Client

CVE-2026-15038Critical
The InfiniteWP Client WordPress plugin before version 1.13.6 improperly verifies the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations. This allows unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9.