CVE-2025-15268

Name of the Vulnerable Software and Affected Versions Infility Global plugin for WordPress versions prior to 2.14.46

Description The Infility Global plugin for WordPress is susceptible to unauthenticated SQL Injection through the 'infility get data' API action. This is a result of inadequate escaping of user-supplied input and insufficient preparation of the SQL query. This allows unauthenticated attackers to potentially append additional SQL queries, and extract sensitive information from the database.

Recommendations Update the Infility Global plugin to a version later than 2.14.46.