This vulnerability is an SQL Injection flaw caused by an improper neutralization of special elements used in a SQL command within the Infility Global plugin for WordPress. An attacker could inject malicious SQL statements that are executed against the site’s database, potentially leading to sensitive data disclosure, unauthorized data modification, or loss of data integrity. The CVSS score of 8.5 reflects the high severity of this flaw.

The Infility Global plugin for WordPress, supplied by Infility and named Infility Global, is affected for all releases from its earliest version through version 2.15.06. Users running any of these versions are susceptible to exploitation.

The EPSS score of less than 1% indicates that exploitation attempts are expected to be rare, though not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers would most likely deliver malicious input through the plugin’s public interfaces, such as form submissions or query parameters, allowing unauthorized execution of arbitrary SQL statements. Given the high CVSS, any successful exploitation could compromise the confidentiality, integrity, or availability of the database.