← Back to CVE List
CVE-2026-17576NVD
Description
The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWP_MMB_Comment::get_comments() calls extract() on $args (which silently skips keys that are not valid PHP variable names) but a second foreach($args as $checkbox => $checkbox_val) processes every key, strips the 'iwp_get_comments_' prefix with str_replace(), wraps the remainder in single quotes, and imploded it into an IN(...) clause that is executed via $wpdb->get_results() with no prepare(). Because the request body is read from php://input and JSON-decoded, wp_magic_quotes() never touches the data, so quote characters in keys pass through unaltered. This makes it possible for authenticated attackers, with administrator-level access and above (an administrator can register their own public key via add_site using the plugin's WP-admin-generated activation_key and then issue signed get_comments requests), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Base Metrics
CVSS v3 (3.1)
MEDIUM 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
CWE-89 - CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected & Patched Versions
| Product | Affected Versions | Patched Version |
|---|---|---|
| revmakx InfiniteWP Client | 0 - <= 1.13.9 | N/A |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/05c50442-570b-45cf-816a-c7a5b712ba21?source=cve
- https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.13.6/addons/comments/comments.class.php#L80
- https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.13.6/addons/comments/comments.class.php#L71
- https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.13.6/addons/comments/comments.class.php#L57
- https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.13.6/init.php#L1651
- https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.13.6/init.php#L131
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3655042%40iwp-client&new=3655042%40iwp-client