CVE-2026-15038 InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
Unauthenticated attackers can hijack administrator sessions and take over the network on WordPress Multisite installations using the InfiniteWP Client plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15038?
CVE-2026-15038 is a critical authentication bypass vulnerability in Unknown InfiniteWP Client, published on 9 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.
Weakness: CWE-287
Which versions are affected by CVE-2026-15038?
How do I fix CVE-2026-15038?
No fix has been published for CVE-2026-15038 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-15038 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-15038 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-5r79-75x7-rrwq.