CVEvulnerability

CVE-2026-15038

9.8 CRITICAL Published 2026-08-09 Modified 2026-08-26 Official page ↗
Status
Deferred
Published
2026-08-09
Last modified
2026-08-26
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287

Description

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References