{"id":"CVE-2026-15038","title":"The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated att…","summary":"The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated att…","severity":"none","published":"2026-08-09","updated":"2026-08-09","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15038","references":[{"url":"https://wpscan.com/vulnerability/629d655f-cdb8-4733-81d5-12fa88c32bb6/","label":"contact@wpscan.com"}],"tags":["nvd","exploit-available"],"ingestedAt":"2026-08-09T13:33:29.126Z","epss":0.00588,"epssPercentile":0.46797,"exploits":{"github":1,"githubRepos":["https://github.com/Polosss/By-Poloss..-..CVE-2026-15038-POC"],"checkedAt":"2026-09-23T07:13:48.806Z"},"exploitAvailable":true,"slug":"CVE-2026-15038","body":"## Overview\n\nThe InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":15,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4959,"id":"CVE-2026-15038","ts":1788887219861,"field":"exploit_available","old":"false","new":"true"},{"seq":3842,"id":"CVE-2026-15038","ts":1788886352502,"field":"exploit_available","old":"true","new":"false"},{"seq":2676,"id":"CVE-2026-15038","ts":1788883017152,"field":"exploit_available","old":"false","new":"true"},{"seq":1705,"id":"CVE-2026-15038","ts":1788882421710,"field":"exploit_available","old":"true","new":"false"},{"seq":812,"id":"CVE-2026-15038","ts":1788881855558,"field":"exploit_available","old":"false","new":"true"}]}