Is CVE-2026-7842 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7842 being exploited in the wild.

How severe is CVE-2026-7842?

Informational severity, with a CVSS score of 6.8, published 23 June 2026.

Is there a fix for CVE-2026-7842?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-7842 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-7842?

Check whether you run Infility Global at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7842: Infility Global WordPress plugin SQL injection in admin callbacks

CVE-2026-7842 · Severity: info · CVSS 6.8 · Published 2026-06-23

The Infility Global plugin for WordPress, which provides data management and import features, contains a security flaw that allows authorized users with 'Editor' permissions to access sensitive database information. By sending specially crafted requests to the plugin's administration pages, an attacker can bypass security controls to extract data such as user credentials or site configuration. This could lead to a full site takeover if administrative credentials are recovered.

Technologies: Infility Global. Vendors: Infility Global.

Quick answers

Is CVE-2026-7842 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7842 being exploited in the wild.
How severe is CVE-2026-7842?: Informational severity, with a CVSS score of 6.8, published 23 June 2026.
Which products and versions are affected?: Infility Global < 2.15.20.
Is there a fix for CVE-2026-7842?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7842 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-7842?: Check whether you run Infility Global at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A time-based blind SQL injection vulnerability exists in the Infility Global WordPress plugin before version 2.15.20. The issue resides in the import_list(), url_detail(), and file_detail() admin page callbacks, which fail to sanitize the 'orderby' and 'order' parameters before incorporating them into SQL queries. An authenticated attacker with Editor-level privileges or higher can exploit this by injecting SQL SLEEP commands to confirm and extract data from the database. For the vulnerability to be exploitable, the 'ImportData' module must be manually enabled in the plugin settings. The issue is fixed in version 2.15.20.

Affected products

Infility Global Infility Global < 2.15.20

Timeline

2026-06-02: disclosed: Public disclosure via WPScan
2026-06-23: advisory: NVD publication date

References

https://wpscan.com/vulnerability/210303c4-0964-4a01-ac8e-13d7c7f424a2/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.