PT-2026-5884 · WordPress · Infility Global

Andrea Bocchetti · Publicado 2026-02-04 · Atualizado 2026-02-09 · CVE-2025-15268

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Infility Global plugin for WordPress versions prior to 2.14.46

Description The Infility Global plugin for WordPress is susceptible to unauthenticated SQL Injection through the 'infility get data' API action. This is a result of inadequate escaping of user-supplied input and insufficient preparation of the SQL query. This allows unauthenticated attackers to potentially append additional SQL queries, and extract sensitive information from the database.

Recommendations Update the Infility Global plugin to a version later than 2.14.46.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-15268

Produtos afetados

Infility Global

Referências · 9

• https://twitter.com/VulmonFeeds/status/2019021854443176014 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/infility_global.php?marks=626#L626 · Nota
• https://t.me/cveNotify/150829 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/648941b8-d1ab-4587-bd87-f23008ac9a00?source=cve · Nota
• https://t.me/CVEtracker/43699 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-15268 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/include/class/str.class.php?marks=21#L21 · Nota
• https://twitter.com/cracbot/status/2020814985845514610 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/include/class/db.class.php?marks=41#L41 · Nota