PT-2026-5884 · WordPress · Infility Global

Andrea Bocchetti · Published 2026-02-04 · Updated 2026-02-09 · CVE-2025-15268

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Infility Global plugin for WordPress versions prior to 2.14.46

Description The Infility Global plugin for WordPress is susceptible to unauthenticated SQL Injection through the 'infility get data' API action. This is a result of inadequate escaping of user-supplied input and insufficient preparation of the SQL query. This allows unauthenticated attackers to potentially append additional SQL queries, and extract sensitive information from the database.

Recommendations Update the Infility Global plugin to a version later than 2.14.46.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-15268

Affected Products

Infility Global

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-15268 · Security Note
• https://twitter.com/VulmonFeeds/status/2019021854443176014 · Twitter Post
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/infility_global.php?marks=626#L626 · Note
• https://t.me/cveNotify/150829 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/648941b8-d1ab-4587-bd87-f23008ac9a00?source=cve · Note
• https://t.me/CVEtracker/43699 · Telegram Post
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/include/class/str.class.php?marks=21#L21 · Note
• https://twitter.com/cracbot/status/2020814985845514610 · Twitter Post
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/include/class/db.class.php?marks=41#L41 · Note