The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the getcomments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWPMMBComment::getcomments() calls extract() on $args (which silently skips keys that are not valid PHP variable names) but a second foreach($args as $checkbox => $checkboxval) processes every key, strips the 'iwpgetcomments' prefix with strreplace(), wraps the remainder in single quotes, and imploded it into an IN(...) clause that is executed via $wpdb->getresults() with no prepare(). Because the request body is read from php://input and JSON-decoded, wpmagicquotes() never touches the data, so quote characters in keys pass through unaltered. This makes it possible for authenticated attackers, with administrator-level access and above (an administrator can register their own public key via addsite using the plugin's WP-admin-generated activationkey and then issue signed getcomments requests), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.