Vulnerability · Published Aug 9, 2026 · Assigned by WPScan

CVE-2026-15038InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite

Critical 9.8

In plain English

A critical-severity improper authentication in InfiniteWP Client from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 44.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Unknown	InfiniteWP Client	0 – before 1.13.6

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/629d655f-cdb8-4733-81d5-12fa88c32bb6/ exploit, vdb-entry, technical-description