CVE-2025-15268: Infility Global <= 2.14.46 - Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass
The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infilitygetdata' API action in all versions up to, and including, 2.14.46. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append - with certain server configurations - additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15268?
CVE-2025-15268 has been classified as a high severity vulnerability.
How do I fix CVE-2025-15268?
To fix CVE-2025-15268, you should update the Infility Global plugin to version 2.14.47 or later.
What impact does CVE-2025-15268 have on my application?
CVE-2025-15268 allows unauthenticated SQL injection, which can lead to unauthorized data access or manipulation.
Is my WordPress site affected by CVE-2025-15268?
If you are using Infility Global versions up to and including 2.14.46, your WordPress site is vulnerable to CVE-2025-15268.
What can I do to prevent CVE-2025-15268 in the future?
To prevent vulnerabilities like CVE-2025-15268, regularly update plugins and monitor for any security advisories.