CVE-2026-8163

Infility Global < 2.15.19 - Subscriber+ SQL Injection via order Parameter

High · published June 23, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Published
2026-06-23T06:00Z
EPSS history
Timeline
  • 23 JUN 06:00Z
    Infility Global < 2.15.19 - Subscriber+ SQL Injection via order Parameter
    cvelistv5