CVE-2026-8685: Infility Global Plugin SQLi Vulnerability

CVE-2026-8685 Overview

CVE-2026-8685 is a SQL Injection vulnerability in the Infility Global plugin for WordPress, affecting all versions up to and including 2.15.16. The flaw resides in the show_control_data::post_list() function, which fails to properly escape and prepare the orderby and order parameters used in SQL queries. The function is registered as an admin menu page that only requires the read capability, meaning Subscriber-level authenticated users can reach it. Attackers can append additional SQL statements to existing queries and extract sensitive data from the WordPress database [CWE-89].

Critical Impact

Authenticated attackers holding Subscriber-level access or higher can execute arbitrary SQL queries to exfiltrate sensitive database contents, including user credentials and personally identifiable information.

Affected Products

• Infility Global plugin for WordPress, versions up to and including 2.15.16
• WordPress installations exposing Subscriber-level registration with the plugin enabled
• Sites using the show-control-data widget shipped with the plugin

Discovery Timeline

• 2026-05-20 - CVE-2026-8685 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-8685

Vulnerability Analysis

The vulnerability exists in the show-control-data.php widget file of the Infility Global plugin. The show_control_data::post_list() method constructs a SQL query that incorporates the orderby and order request parameters directly. The plugin does not apply sufficient escaping on these user-supplied values, nor does it use parameterized statements through $wpdb->prepare() correctly. As a result, attacker-controlled input passes into the SQL execution path with insufficient sanitization.

The administrative page hosting this function is registered with only the read capability requirement. In WordPress, the read capability is granted to all authenticated roles, including the lowest-privileged Subscriber role. This significantly broadens the attacker pool compared to typical admin-only SQL injection issues.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The orderby and order parameters are concatenated into the query string without being whitelisted against valid column names or sort directions. WordPress's $wpdb->prepare() function does not safely handle identifiers like column names through placeholder substitution, so developers must validate these values against an allowlist. The plugin omits this control.

Attack Vector

An attacker first registers or obtains a Subscriber-level account on a vulnerable WordPress site. The attacker then sends an authenticated request to the admin page exposing the show_control_data::post_list() function, supplying a crafted orderby or order parameter containing SQL syntax such as a UNION SELECT payload or a time-based blind injection. The injected SQL executes within the context of the database user backing WordPress, allowing extraction of arbitrary table contents including the wp_users table.

No verified exploitation code is published. Refer to the Wordfence Vulnerability Advisory and the WordPress Plugin Code Review for the vulnerable source lines.

Detection Methods for CVE-2026-8685

Indicators of Compromise

• Web server access logs containing requests to the Infility Global admin page with SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA inside the orderby or order query string parameters
• Unusual database query patterns or long-running queries originating from low-privileged WordPress sessions
• Creation of new administrator accounts or password hash exports shortly after Subscriber account logins

Detection Strategies

• Inspect WordPress access logs for authenticated requests to admin pages from accounts with Subscriber or Contributor roles
• Deploy a Web Application Firewall rule that flags non-alphanumeric characters in orderby and order parameters across plugin endpoints
• Enable WordPress database query logging or MySQL general query log review for queries containing concatenated ORDER BY clauses with suspicious tokens

Monitoring Recommendations

• Monitor for unexpected new WordPress user registrations followed by access to plugin admin pages
• Alert on outbound HTTP responses with abnormally large payloads from admin endpoints, indicating possible data exfiltration
• Track failed and successful authentication anomalies against Subscriber-tier accounts

How to Mitigate CVE-2026-8685

Immediate Actions Required

• Disable or remove the Infility Global plugin until a patched release is confirmed and deployed
• Disable open user registration or restrict the default registration role to prevent untrusted Subscriber account creation
• Audit existing Subscriber-level accounts and remove unrecognized users
• Rotate WordPress administrator passwords and database credentials if exploitation is suspected

Patch Information

At the time of publication, no fixed version is identified in the NVD record. All versions up to and including 2.15.16 are vulnerable. Review the Wordfence Vulnerability Advisory for the latest fixed version availability and apply the vendor patch as soon as it is released.

Workarounds

• Restrict access to /wp-admin/ for low-privileged roles using server-level rules or a security plugin
• Apply a Web Application Firewall virtual patch that validates orderby against a strict allowlist of column names and order against ASC or DESC
• Remove the Infility Global plugin directory from the WordPress installation if it is not actively required

# Example WAF rule (ModSecurity) blocking SQLi in orderby/order parameters
SecRule ARGS:orderby|ARGS:order "@rx (?i)(union|select|sleep|benchmark|information_schema|--|;|/\*)" \
    "id:1008685,phase:2,deny,status:403,log,msg:'CVE-2026-8685 Infility Global SQLi attempt'"