Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-17576— InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key

Quick assessment

Affected
revmakx InfiniteWP Client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 InfiniteWP Client 插件在 1.13.9 及更早版本中存在 SQL 注入漏洞，该漏洞位于 操作中。 漏洞成因是对 JSON 请求体中提供的数组键名（array-key names）在使用前未进行充分的转义处理。具体而言， 函数对 调用了 函数（该函数会静默跳过无效的 PHP 变量名键），但随后第二个 循环会处理每一个键。该循环使用 去除 前缀，将剩余部分用单引号包裹，然后通过 拼接进 子句，并最终通过 执行，且未使用 进行参数化查询。 由于请求体是从 读取并进行 JSON 解

CVSS 6.5 · Medium EPSS 0.27% · P20

Possible ATT&CK Techniques 1 AI

T1190.002

Affected Version Matrix 1

VendorProduct Version RangeStatus
revmakx InfiniteWP Client ≤ 1.13.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-17576

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
Source: CVE Program / CVE List V5
Vulnerability Description
The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWP_MMB_Comment::get_comments() calls extract() on $args (which silently skips keys that are not valid PHP variable names) but a second foreach($args as $checkbox => $checkbox_val) processes every key, strips the 'iwp_get_comments_' prefix with str_replace(), wraps the remainder in single quotes, and imploded it into an IN(...) clause that is executed via $wpdb->get_results() with no prepare(). Because the request body is read from php://input and JSON-decoded, wp_magic_quotes() never touches the data, so quote characters in keys pass through unaltered. This makes it possible for authenticated attackers, with administrator-level access and above (an administrator can register their own public key via add_site using the plugin's WP-admin-generated activation_key and then issue signed get_comments requests), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
revmakx InfiniteWP Client 0 ~ 1.13.9 -

II. Public POCs for CVE-2026-17576

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-17576

请登录查看更多情报信息。

Other References for CVE-2026-17576 (5)

IV. Related Vulnerabilities

Same product: InfiniteWP Client
Same vendor: revmakx
Same weakness: CWE-89

V. Comments for CVE-2026-17576

No comments yet

Leave a comment