# CVE-2026-8685: Infility Global WordPress plugin SQL injection in post_list

Source: https://junglewise.ai/threats/cve-2026-8685-infility-global-wordpress-plugin-sql-injection-in-post-list  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-8685 · Severity: medium · CVSS 6.5 · Published 2026-05-20

The Infility Global plugin for WordPress, which provides data display and control widgets, contains a security flaw that allows users with low-level account access to perform unauthorized database queries. By exploiting this vulnerability, an attacker could extract sensitive information from the website's database, potentially compromising user data or site configuration. This issue affects all versions of the plugin up to and including 2.15.16.

Technologies: [Infility Global](https://junglewise.ai/threats/technologies/infility-global). Vendors: [Infility Global](https://junglewise.ai/threats/vendors/infility-global).

## Quick answers

**Is CVE-2026-8685 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8685 being exploited in the wild.

**How severe is CVE-2026-8685?** Medium severity, with a CVSS score of 6.5, published 20 May 2026.

**Which products and versions are affected?** Infility Global up to, and including, 2.15.16.

**Is there a fix for CVE-2026-8685?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8685 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8685?** Check whether you run Infility Global at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Infility Global plugin for WordPress is vulnerable to SQL Injection due to insufficient escaping of user-supplied parameters and a lack of SQL query preparation within the show_control_data::post_list() function. The vulnerability specifically affects the 'orderby' and 'order' parameters. This function is registered as an admin menu page requiring only 'read' capabilities, allowing authenticated attackers with Subscriber-level access or higher to inject malicious SQL commands. An attacker can leverage this to append additional queries to existing database calls and extract sensitive information. The issue is present in all versions up to and including 2.15.16.

## Affected products

- Infility Global Infility Global up to, and including, 2.15.16

## Timeline

- 2026-05-20: advisory: NVD publication date

## References

- [https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php](https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php)
- [https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php](https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php)
- [https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php](https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php)
- [https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php](https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/1caeb5e0-9e4e-4c9e-a6e4-881fb81dc5f2?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/1caeb5e0-9e4e-4c9e-a6e4-881fb81dc5f2?source=cve)

## Related threats

- [Infility Global WordPress plugin SQL injection in order parameter](https://junglewise.ai/threats/cve-2026-8163-infility-global-wordpress-plugin-sql-injection-in-order-parameter)
- [Infility Global WordPress plugin SQL injection in admin callbacks](https://junglewise.ai/threats/cve-2026-7842-infility-global-wordpress-plugin-sql-injection-in-admin-callbacks)