CVE-2026-15038: InfiniteWP Client WordPress RCE Flaw

CVE-2026-15038 Overview

CVE-2026-15038 affects the InfiniteWP Client WordPress plugin in versions before 1.13.6. The plugin fails to properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations. Unauthenticated attackers can bind their own key to the client, hijack an administrator session, and take over the entire network. Successful exploitation leads to remote code execution across the Multisite deployment. The vulnerability is tracked under [CWE-287] Improper Authentication.

Critical Impact
Unauthenticated network attackers can seize administrator control of WordPress Multisite networks running vulnerable InfiniteWP Client versions, resulting in full network takeover and remote code execution.

Affected Products

InfiniteWP Client WordPress plugin versions prior to 1.13.6
WordPress Multisite installations running the vulnerable plugin
WordPress sites remotely managed through InfiniteWP

Discovery Timeline

2026-08-09 - CVE-2026-15038 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-15038

Vulnerability Analysis

The InfiniteWP Client plugin exposes a remote-management endpoint used by the InfiniteWP administration console to manage WordPress sites. On WordPress Multisite installations, the plugin does not correctly validate whether the site is already connected to a legitimate InfiniteWP admin instance. It also fails to authenticate incoming management requests to that endpoint.

An attacker can send a crafted request that binds an attacker-controlled cryptographic key to the client. Once the malicious key is registered, subsequent requests signed with that key are treated as authenticated administrator actions. The attacker then hijacks an administrator session and issues management commands across every site in the network.

Because InfiniteWP supports operations such as plugin installation, theme upload, and file management, session hijacking translates directly into remote code execution on the underlying host.

Root Cause

The root cause is an authentication flaw [CWE-287] in the plugin's Multisite request-handling logic. The endpoint accepts key-binding requests without verifying that the site is in an unconnected state or that the caller possesses a pre-shared secret. Missing state checks and missing request authenticity checks combine into a bypass primitive.

Attack Vector

Exploitation is fully remote and unauthenticated. An attacker sends HTTP requests to the exposed InfiniteWP endpoint on a target Multisite installation. After binding an attacker-controlled key, the attacker issues administrator-level commands, escalates to network superadmin, and delivers a malicious plugin or theme archive to obtain code execution. See the WPScan Vulnerability Report for technical details.

No verified public exploit code is available at the time of writing.

Detection Methods for CVE-2026-15038

Indicators of Compromise

Unexpected POST requests to the InfiniteWP Client endpoint (typically the site root with the iwp_action parameter or an _IWP_JSON_PREFIX_ body marker) from unknown source IP addresses.
New or modified rows in the plugin's connection metadata storing an unrecognized public key or admin identifier.
Newly installed plugins, themes, or superadmin accounts appearing on Multisite networks without a matching change-management ticket.

Detection Strategies

Inspect webserver access logs for anonymous requests targeting the InfiniteWP endpoint that reference key-binding or authentication actions.
Correlate WordPress wp_options and site metadata changes with unauthenticated HTTP traffic to detect malicious key registration.
Alert on file writes to wp-content/plugins/ and wp-content/mu-plugins/ that occur immediately after external requests to the InfiniteWP endpoint.

Monitoring Recommendations

Enable WordPress audit logging for superadmin creation, plugin installation, and file uploads across every site in the Multisite network.
Forward webserver and PHP error logs to a centralized analytics platform and build detections around the InfiniteWP request patterns above.
Baseline outbound connections from the WordPress host so that post-exploitation callbacks stand out.

How to Mitigate CVE-2026-15038

Immediate Actions Required

Update the InfiniteWP Client plugin to version 1.13.6 or later across every site in the Multisite network.
Audit the connection metadata stored by the plugin and remove any unknown or unexpected keys and administrator bindings.
Rotate WordPress administrator and superadmin credentials, and invalidate active sessions after patching.
Review recently installed plugins, themes, and user accounts for unauthorized additions.

Patch Information

Upgrade the InfiniteWP Client plugin to version 1.13.6, which introduces proper connection-state and request-authenticity checks on the remote-management endpoint. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate and remove the InfiniteWP Client plugin on Multisite installations until the patched version can be deployed.
Restrict access to the WordPress site root and the InfiniteWP endpoint at the web application firewall or reverse proxy, allowing only the IP addresses of the legitimate InfiniteWP admin console.
Disable public network exposure of Multisite management endpoints and require VPN access for administrative traffic.

bash

# Example Nginx allowlist restricting the InfiniteWP endpoint to the admin console IP
location = /index.php {
    if ($request_body ~* "_IWP_JSON_PREFIX_") {
        set $iwp 1;
    }
    if ($iwp = 1) {
        allow 203.0.113.10;   # InfiniteWP admin console
        deny all;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}