CVE-2026-15038
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.
- Affected products
- Infinitewp Client
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 0.4% (35th percentile)
- Weakness
- CWE-287
- NVD status
- Received
- Published
- 2026-08-09
CVE-2026-15038 at NVD
1 known exploit for CVE-2026-15038
Proof-of-concept code and exploit modules indexed by Sploitus