CVE-2026-17576: InfiniteWP Client WordPress SQL Injection

CVE-2026-17576 Overview

CVE-2026-17576 is an authenticated SQL injection vulnerability in the InfiniteWP Client plugin for WordPress, affecting all versions up to and including 1.13.9. The flaw resides in the IWP_MMB_Comment::get_comments() handler, which processes JSON-encoded request bodies without sanitizing attacker-controlled array keys before concatenating them into a raw SQL statement. Authenticated attackers with administrator-level access can append arbitrary SQL to an existing query and exfiltrate sensitive information from the WordPress database. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated administrators can execute arbitrary SQL queries against the WordPress database via crafted JSON keys, enabling extraction of user credentials, session tokens, and other stored secrets.

Affected Products

InfiniteWP Client plugin for WordPress, versions up to and including 1.13.9
WordPress sites managed through the InfiniteWP remote administration platform
Any WordPress installation exposing the plugin's add_site and get_comments actions

Discovery Timeline

2026-09-18 - CVE-2026-17576 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-17576

Vulnerability Analysis

The defect exists in the comments add-on shipped with the InfiniteWP Client plugin. The get_comments action accepts a JSON request body that is parsed and stored in the $args array. The handler then calls extract($args), which silently discards keys that are not valid PHP variable names, but a subsequent foreach($args as $checkbox => $checkbox_val) loop iterates over every key regardless of its content.

Inside the loop, the plugin strips the iwp_get_comments_ prefix from each key using str_replace(), wraps the remaining substring in single quotes, and joins the values into an IN(...) clause. That clause is passed directly to $wpdb->get_results() without a call to $wpdb->prepare(), allowing quote characters embedded in the keys to break out of the intended literal and inject arbitrary SQL.

Root Cause

Because the request body is read from php://input and JSON-decoded, WordPress's wp_magic_quotes() routine never processes the payload. Quote characters supplied by the attacker pass through unaltered into the query builder. The combination of missing input sanitization, missing parameterization, and reliance on extract() for filtering produces a classic second-order injection sink [CWE-89].

Attack Vector

Exploitation requires administrator-level access on the target WordPress site. An administrator can register their own public key against the plugin by calling add_site with the WP-admin-generated activation_key. Once registered, the attacker signs a JSON get_comments request whose top-level keys contain SQL fragments such as iwp_get_comments_1') UNION SELECT user_login,user_pass FROM wp_users-- -. The plugin decodes the body, drops the prefix, and concatenates the payload into the executed statement, returning the injected result set to the caller.

No verified public exploit code is currently available. Technical details on the vulnerable code paths are documented in the Wordfence Vulnerability Analysis and the plugin source at comments.class.php line 57.

Detection Methods for CVE-2026-17576

Indicators of Compromise

HTTP POST requests to the WordPress site with Content-Type: application/json targeting the InfiniteWP Client endpoint and containing the get_comments action.
JSON request bodies whose top-level keys contain single quotes, UNION, SELECT, --, or other SQL metacharacters after the iwp_get_comments_ prefix.
Unexpected add_site registrations followed shortly by signed get_comments requests from previously unseen source addresses.
Database error entries referencing wp_comments or malformed IN(...) clauses originating from the plugin.

Detection Strategies

Inspect web server access logs for POST requests to / or /wp-admin/admin-ajax.php carrying InfiniteWP signed payloads with anomalous key structures.
Enable MySQL general query logging on non-production hosts and search for get_results queries containing unbalanced quotes inside IN(...) clauses tied to comment lookups.
Correlate WordPress user activity with plugin activation-key issuance events to identify unauthorized add_site registrations.

Monitoring Recommendations

Alert on new administrator account creations followed by InfiniteWP add_site API calls within a short window.
Monitor for outbound HTTP responses from the plugin endpoint that return unusually large payloads consistent with database exfiltration.
Baseline the expected volume of get_comments requests per managed site and flag statistical deviations.

How to Mitigate CVE-2026-17576

Immediate Actions Required

Upgrade the InfiniteWP Client plugin to a version later than 1.13.9 on every managed WordPress site.
Audit all WordPress administrator accounts and revoke credentials that are no longer required or that show signs of misuse.
Rotate the InfiniteWP activation_key values for any site suspected of unauthorized add_site calls.

Patch Information

The fix is tracked in the plugin's public source repository. Review the WordPress Plugin Changeset Details for the exact code modifications. Site operators should install the fixed release through the WordPress plugin updater or by deploying the vendor-supplied package to wp-content/plugins/iwp-client/.

Workarounds

Temporarily deactivate the InfiniteWP Client plugin on sites that cannot be patched immediately.
Restrict network access to the WordPress admin surface using an IP allowlist covering only trusted InfiniteWP management infrastructure.
Enforce multi-factor authentication for all administrator accounts to raise the cost of the prerequisite privilege escalation step.
Deploy a web application firewall rule that rejects JSON request bodies whose keys contain single quotes or SQL keywords when the target action is get_comments.

bash

# Example WAF rule (ModSecurity) blocking suspicious JSON keys targeting the plugin
SecRule REQUEST_URI "@rx /(wp-admin/admin-ajax\.php|index\.php)" \
  "id:1017576,phase:2,deny,status:403,msg:'InfiniteWP get_comments SQLi attempt',\
   chain"
  SecRule REQUEST_BODY "@rx iwp_get_comments_[^\"']*['\"].*(UNION|SELECT|--|/\*)" \
    "t:none,t:lowercase"