Executive brief
The Infility Global plugin for WordPress, which provides data management and import features, contains a security flaw that allows authorized users with 'Editor' permissions to access sensitive database information. By sending specially crafted requests to the plugin's administration pages, an attacker can bypass security controls to extract data such as user credentials or site configuration. This could lead to a full site takeover if administrative credentials are recovered.
Technical details
A time-based blind SQL injection vulnerability exists in the Infility Global WordPress plugin before version 2.15.20. The issue resides in the import_list(), url_detail(), and file_detail() admin page callbacks, which fail to sanitize the 'orderby' and 'order' parameters before incorporating them into SQL queries. An authenticated attacker with Editor-level privileges or higher can exploit this by injecting SQL SLEEP commands to confirm and extract data from the database. For the vulnerability to be exploitable, the 'ImportData' module must be manually enabled in the plugin settings. The issue is fixed in version 2.15.20.
Affected products
- Infility Global Infility Global < 2.15.20
Timeline
- 2026-06-02: disclosed: Public disclosure via WPScan
- 2026-06-23: advisory: NVD publication date