CVE-2026-8685

MediumCVSS 6.5/10Last modified Jul 23, 2026

Description

The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16. This is due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query within the show_control_data::post_list() function, which is registered as an admin menu page with only the 'read' capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 20, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-868506.5The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions,CVE-2026-868516.5The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parame CVE-2026-868534.3A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make CVE-2026-868566.5A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues ar CVE-2026-868578.4ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if CVE-2026-868588.7ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue c CVE-2026-868598.7ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if CVE-2026-86869.1Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by se CVE-2026-868609.3ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could CVE-2026-868615.9pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.c CVE-2026-868626.5pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to CVE-2026-868639.8pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmi