CVE-2026-15038 | BDVDB-2026-356455 Detail

Description#

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-09Record published in the CVE List.
2. Version 22026-08-10Most recent update recorded in the CVE List.