Is CVE-2026-17576 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17576 being exploited in the wild.

How severe is CVE-2026-17576?

Medium severity, with a CVSS score of 6.5, published 18 September 2026.

Which products and versions are affected?

InfiniteWP Client up to and including 1.13.9.

Is there a fix for CVE-2026-17576?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-17576 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-17576?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17576: InfiniteWP Client SQL injection in get_comments

CVE-2026-17576 · Severity: medium · CVSS 6.5 · Published 2026-09-18

The InfiniteWP Client plugin, a server management tool widely used by WordPress administrators, contains a SQL injection vulnerability in its comments handling. An authenticated administrator-level attacker can exploit this flaw to extract sensitive data from the WordPress database, such as user credentials, private posts, or customer information, potentially leading to further compromise of the WordPress installation.

Quick answers

Is CVE-2026-17576 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17576 being exploited in the wild.
How severe is CVE-2026-17576?: Medium severity, with a CVSS score of 6.5, published 18 September 2026.
Which products and versions are affected?: InfiniteWP Client up to and including 1.13.9.
Is there a fix for CVE-2026-17576?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-17576 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-17576?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the IWP_MMB_Comment::get_comments() method, which processes JSON request parameters without proper escaping before constructing SQL queries. The code calls extract() on user-supplied arguments, then iterates over them, strips a prefix with str_replace(), wraps values in quotes, and concatenates them directly into an IN() clause that is executed via $wpdb->get_results() without using prepare(). Because the request body is JSON-decoded and bypasses WordPress's magic_quotes sanitization, quote characters in parameter keys pass through unescaped. An authenticated administrator can register a public key and issue signed requests to append arbitrary SQL code, allowing database content extraction. The vulnerability affects versions up to and including 1.13.9 and requires administrator-level access.

Affected products

InfiniteWP Client up to and including 1.13.9

Timeline

2026-09-18: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.