What’s Vulnerable › Vulnerabilities
CVE-2026-7842: Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-23 · updated 2026-06-23
Description
The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.
Affected products
- Infility Global: before 2.15.20 — fixed in 2.15.20
How to fix
Upgrade to a fixed version: Infility Global 2.15.20. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-7842 or the next vulnerability affects your stack