CVE-2026-15038

9.8 Critique

Publiée le 09/08/2026 à 08:17 · Modifiée le 26/08/2026 à 18:31 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.

Traduire en français

Produits concernés

Unknown InfiniteWP Client

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-287

Références

https://wpscan.com/vulnerability/629d655f-cdb8-4733-81d5-12fa88c32bb6/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories