CVE-2026-7842 Details
Description
The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.
A SQL injection vulnerability has been identified in the Infility Global WordPress plugin, affecting versions prior to 2.15.20. The vulnerability arises because the plugin does not properly sanitize or validate the orderby and order parameters in several admin page callbacks before using them in SQL queries. This flaw allows authenticated attackers with Editor-level access or higher to execute time-based blind SQL injection, potentially leading to the extraction of sensitive data from the database. To exploit this vulnerability, the ImportData module must be enabled via the plugin's module toggle page.
Users are advised to update the Infility Global WordPress plugin to version 2.15.20 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 23, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/210303c4-0964-4a01-ac8e-13d7c7f424a2/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Infility Global | < 2.15.20 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |