CVE-2026-7842: Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter
The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the importlist(), urldetail(), and filedetail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Infility Global WordPress pluginto a version that resolves this vulnerability.Fixed in 2.15.20
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7842?
The severity of CVE-2026-7842 is medium with a CVSS score of 6.8.
What type of vulnerability is associated with CVE-2026-7842?
CVE-2026-7842 is an SQL Injection vulnerability found in the Infility Global WordPress plugin.
How do I fix CVE-2026-7842?
To fix CVE-2026-7842, update the Infility Global WordPress plugin to version 2.15.20 or later.
Who is affected by CVE-2026-7842?
CVE-2026-7842 affects authenticated attackers with Editor-level privileges on WordPress sites using the vulnerable plugin.
What can attackers achieve by exploiting CVE-2026-7842?
Attackers exploiting CVE-2026-7842 can manipulate SQL queries due to unsanitized input, potentially accessing sensitive data.