{"id":"CVE-2026-15038","aliases":["EUVD-2026-54882","GHSA-5r79-75x7-rrwq"],"status":"published","title":"InfiniteWP Client \u003c 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite","description":"The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00759,"percentile":0.5559,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2026-08-09T06:00:14Z","modified":"2026-08-26T16:31:16Z","exploits":[{"source":"pocgithub","id":"Polosss/By-Poloss..-..CVE-2026-15038-POC","title":"Polosss/By-Poloss..-..CVE-2026-15038-POC","date":"2026-08-09","url":"https://github.com/Polosss/By-Poloss..-..CVE-2026-15038-POC"}],"products":[{"vendor":"infinitewp","product":"infinitewp client"},{"vendor":"unknown","product":"infinitewp client"}],"references":[{"url":"https://wpscan.com/vulnerability/629d655f-cdb8-4733-81d5-12fa88c32bb6/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15038"},{"url":"https://wpscan.com/vulnerability/629d655f-cdb8-4733-81d5-12fa88c32bb6"},{"url":"https://github.com/advisories/GHSA-5r79-75x7-rrwq"}],"sources":{"cve":[{"id":"CVE-2026-15038","title":"InfiniteWP Client \u003c 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite","description":"The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.","status":"published","published":"2026-08-09T06:00:14.091Z","modified":"2026-08-10T19:33:40.598Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-54882","description":"The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.","status":"published","published":"2026-08-09T06:00:14Z","modified":"2026-08-10T19:33:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:01.104981Z"}],"ghsa":[{"id":"GHSA-5r79-75x7-rrwq","title":"The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection...","description":"The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.","status":"published","published":"2026-08-09T06:31:35Z","modified":"2026-08-10T21:32:00Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:10:15.841734Z"}],"nvd":[{"id":"CVE-2026-15038","description":"The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.","status":"published","published":"2026-08-09T06:17:16.393Z","modified":"2026-08-26T16:31:16.753Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:35.743275Z"}]}}