The Infility Global plugin for WordPress contains a SQL injection flaw in the show_control_data::post_list() function where the 'orderby' and 'order' parameters are concatenated into a database query without proper escaping. An attacker who is authenticated with Subscriber level access or higher can supply crafted values for these parameters to inject and execute arbitrary SQL, enabling extraction of sensitive information stored in the WordPress database. The vulnerability could be leveraged to compromise database confidentiality and potentially alter data if the attacker chooses destructive queries.

Infility Global plugin for WordPress, versions up to and including 2.15.16.

The CVSS score of 6.5 indicates a moderate severity. Exploitation requires only a legitimate WordPress user with Subscriber or higher privileges, making the attack vector a web application context. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread publicly known exploitation at the time of assessment. Nevertheless, any authenticated user in the specified roles can use the vulnerable parameters to retrieve database content, so the risk of confidential data exposure remains significant.