The Infility Global plugin for WordPress contains a flaw where user‑supplied input is concatenated directly into a database query without proper sanitization. An attacker can exploit this to inject arbitrary SQL statements, enabling the reading, modification, or deletion of data stored in the WordPress database. The vulnerability compromises data confidentiality and integrity, and could also affect availability if critical data is corrupted. The issue is classified as CWE‑89.

Infility Global plugin versions up to and including 2.15.06 are affected. All releases from the earliest available version through 2.15.06 contain the vulnerability, impacting any WordPress site that has installed one of these versions.

The CVSS score of 9.3 flags the flaw as critical and indicates high impact. Its EPSS score of less than 1% suggests that, at present, exploitation is unlikely, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, requiring an HTTP request to the plugin’s input endpoint. While the plugin can receive data from various sources, anyone with access to the site could potentially craft a malicious request, so the risk remains significant for unpatched installations.