CVE-2026-8685

The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16. This is due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query within the show_control_data::post_list() function, which is registered as an admin menu page with only the 'read' capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L34
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L74
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L78
• https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L84
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1caeb5e0-9e4e-4c9e-a6e4-881fb81dc5f2?source=cve

Published

May 20, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86831Improper validation of pod identifier uniqueness in aws-netw…8.7
• CVE-2026-86836In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent c…8.4
• CVE-2026-86837The Bookly WordPress plugin before 28.3 does not properly ve…5.3
• CVE-2026-8684The MotoPress Hotel Booking plugin for WordPress is vulnerab…5.3
• CVE-2026-86840The `vtoken-minting` and `slpx` pallets in Bifrost contain a…9.1
• CVE-2026-86842The Real3D Flipbook WordPress plugin before 5.4 does not pe…6.8
• CVE-2026-86853A malicious webpage could repeatedly trigger external URL sc…4.3
• CVE-2026-86857ServiceNow has remediated an authorization bypass security i…8.4
• CVE-2026-86858ServiceNow has remediated an improper access control securit…8.7
• CVE-2026-86859ServiceNow has remediated an authorization bypass security i…8.7
• CVE-2026-8686Missing bounds validation in the MQTT v5.0 property parser i…9.1
• CVE-2026-86860ServiceNow has remediated a missing authorization vulnerabil…9.3