CVE-2026-15038: InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InfiniteWP Client (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.13.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15038?
CVE-2026-15038 has a risk score of 93, indicating it is a critical vulnerability.
How do I fix CVE-2026-15038?
To fix CVE-2026-15038, update the InfiniteWP Client plugin to version 1.13.6 or later.
What are the potential impacts of CVE-2026-15038?
CVE-2026-15038 allows unauthenticated attackers to hijack administrator sessions on WordPress Multisite installations.
Is CVE-2026-15038 exploitable without authentication?
Yes, CVE-2026-15038 is exploitable by unauthenticated attackers.
What specific software is affected by CVE-2026-15038?
CVE-2026-15038 affects the InfiniteWP Client plugin for WordPress before version 1.13.6.