CVE-2026-8163
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Infility Global WordPress plugin before version 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability. This can be exploited by authenticated users with Subscriber-level access and above.
Risk Assessment
The organization may be exposed to unauthorized access to database information, potentially leading to data leaks or modifications. Low-privileged users could gain access to sensitive information.
Recommendation
It is recommended to update the Infility Global plugin to version 2.15.19 or later to mitigate this vulnerability. Additionally, conducting a security audit to assess the potential impact of this flaw is advisable.
Other vulnerabilities in Infility Global WordPress plugin
See all- CVE-2026-109931Low
The Infility Global WordPress plugin before version 2.16.25 does not perform any authorization or nonce check on an AJAX action available to unauthenticated users. This allows any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before version 2.16.25.
- CVE-2026-7842Medium
The Infility Global plugin for WordPress before version 2.15.20 does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks. This allows authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database.
Original NVD description (English source)
The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS