CVE-2026-8685

The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16. This is due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query within the show_control_data::post_list() function, which is registered as an admin menu page with only the 'read' capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L34
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L74
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L78
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L84
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1caeb5e0-9e4e-4c9e-a6e4-881fb81dc5f2?source=cve

Published

May 20, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86843The Apache Airflow Teradata provider's compute-cluster examp…6.3
• CVE-2026-86845A flaw was found in DPDK lib/vhost vhost-crypto. Session cle…6.5
• CVE-2026-86846A flaw was found in DPDK lib/vhost vhost-crypto. A guest can…6.5
• CVE-2026-86847A flaw was found in DPDK lib/vhost vhost-crypto. Write-back …6.5
• CVE-2026-86848A flaw was found in DPDK lib/vhost vhost-crypto. The indirec…8.8
• CVE-2026-86849A flaw was found in DPDK lib/vhost vhost-crypto. Integer ove…6.5
• CVE-2026-86850The SKU Error Fixer for WooCommerce WordPress plugin through…6.5
• CVE-2026-86851The Livees Checkout WordPress plugin through 7.0.2 does not …6.5
• CVE-2026-86853A malicious webpage could repeatedly trigger external URL sc…4.3
• CVE-2026-86856A flaw was found in the DPDK nfp vDPA driver. Stack and heap…6.5
• CVE-2026-86857ServiceNow has remediated an authorization bypass security i…8.4
• CVE-2026-86858ServiceNow has remediated an improper access control securit…8.7