Executive brief
The InfiniteWP Client plugin, a server management tool widely used by WordPress administrators, contains a SQL injection vulnerability in its comments handling. An authenticated administrator-level attacker can exploit this flaw to extract sensitive data from the WordPress database, such as user credentials, private posts, or customer information, potentially leading to further compromise of the WordPress installation.
Technical details
The vulnerability exists in the IWP_MMB_Comment::get_comments() method, which processes JSON request parameters without proper escaping before constructing SQL queries. The code calls extract() on user-supplied arguments, then iterates over them, strips a prefix with str_replace(), wraps values in quotes, and concatenates them directly into an IN() clause that is executed via $wpdb->get_results() without using prepare(). Because the request body is JSON-decoded and bypasses WordPress's magic_quotes sanitization, quote characters in parameter keys pass through unescaped. An authenticated administrator can register a public key and issue signed requests to append arbitrary SQL code, allowing database content extraction. The vulnerability affects versions up to and including 1.13.9 and requires administrator-level access.
Affected products
- InfiniteWP Client up to and including 1.13.9
Timeline
- 2026-09-18: disclosed