CVE-2026-15038

Name of the Vulnerable Software and Affected Versions InfiniteWP Client WordPress plugin versions prior to 1.13.6

Description On WordPress Multisite installations, the plugin fails to properly verify the site-connection state and the authenticity of requests sent to its remote-management endpoint. This flaw allows unauthenticated attackers to bind their own key and hijack an administrator session, enabling full network takeover and remote code execution (RCE), which is the ability to execute arbitrary commands on the server.

Recommendations Update InfiniteWP Client WordPress plugin to version 1.13.6 or later.