CVE-2026-8163 — Infility Global < 2.15.19 - Subscriber+ SQL Injection via order Parameter
The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnera…
Published: 2026-06-23 · CVSS: 8.8 · CVSS 3.1
The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7