Infility Global WordPress plugin vulnerabilities

The Infility Global WordPress plugin before version 2.16.25 does not perform any authorization or nonce check on an AJAX action available to unauthenticated users. This allows any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before version 2.16.25.

The Infility Global WordPress plugin before version 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability. This can be exploited by authenticated users with Subscriber-level access and above.

The Infility Global plugin for WordPress before version 2.15.20 does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks. This allows authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database.