CVE-2026-17576: InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the getcomments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWPMMBComment::getcomments() calls extract() on $args (which silently skips keys that are not valid PHP variable names) but a second foreach($args as $checkbox => $checkboxval) processes every key, strips the 'iwpgetcomments' prefix with strreplace(), wraps the remainder in single quotes, and imploded it into an IN(...) clause that is executed via $wpdb->getresults() with no prepare(). Because the request body is read from php://input and JSON-decoded, wpmagicquotes() never touches the data, so quote characters in keys pass through unaltered. This makes it possible for authenticated attackers, with administrator-level access and above (an administrator can register their own public key via addsite using the plugin's WP-admin-generated activationkey and then issue signed getcomments requests), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated attacker with administrator-level access or higher can exploit it. The description notes that an administrator can register a public key through the add_site workflow using the plugin's WP-admin-generated activation_key, then send signed get_comments requests.
What attacker-controlled input reaches the vulnerable SQL query?
The attacker controls array-key names in the JSON request body for the get_comments action. Keys beginning with iwp_get_comments_ have that prefix removed, and the remaining text is inserted into an SQL IN(...) clause without parameterized preparation or adequate escaping.
Is a special deployment configuration required for exploitation?
The described attack uses the plugin's existing add_site and signed get_comments request functionality. No additional non-default configuration requirement is identified in the provided information.
What data could be exposed if the issue is exploited?
The injection can append additional SQL queries to existing queries and may be used to extract sensitive information. The provided data does not identify specific database tables or records at risk.