Read the docs
TI-2026-06901 Aliases CVE-2026-7842GHSA-jgxx-4fc8-ff8f

Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter

Priority MEDIUM 63Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00391 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Infility Global (Unknown): 2.15.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownInfility Globalbefore 2.15.202.15.20Patch availableCNA
  • Infility Global VendorUnknown Affected before 2.15.20 Fixed in 2.15.20 Patch available CNA

Remediation

  • Fix · CNA Infility Global (Unknown) Fixed in 2.15.20

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7842
  2. 2026-10-03 Alias added: GHSA-jgxx-4fc8-ff8f

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences