What’s Vulnerable › Vulnerabilities
CVE-2026-15038: InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-09 · updated 2026-08-26
- Weakness: CWE-287
Description
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.
Affected products
- InfiniteWP Client: before 1.13.6 — fixed in 1.13.6
How to fix
Upgrade to a fixed version: InfiniteWP Client 1.13.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-15038 or the next vulnerability affects your stack