CVE-2026-74011: WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection.
This issue affects InfiniteWP Client: from n/a through 1.13.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress InfiniteWP Client Pluginto a version that resolves this vulnerability.Fixed in 1.13.10
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires high privileges (PR:H). It is remotely exploitable over the network, has low attack complexity, and does not require user interaction.
What is the likely impact if exploitation succeeds?
The issue allows blind SQL injection and is rated high severity (7.6). The supplied vector indicates high confidentiality impact, low availability impact, no integrity impact, and impact beyond the vulnerable security authority (S:C).
Which InfiniteWP Client versions are affected?
InfiniteWP Client versions through 1.13.9 are affected. The provided data does not identify a fixed version or an available mitigation.