CVE-2026-74011: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in revmakx InfiniteWP Client

This vulnerability (CVE-2026-74011) in revmakx InfiniteWP Client is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). It allows blind SQL injection attacks due to insufficient sanitization of SQL inputs. The CVSS 3.1 base score is 7.6, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. Affected versions include all versions up to 1.13.9. No vendor advisory or patch information is available at this time.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact) and partial denial of service (low availability impact). Integrity is not impacted. The attack requires high privileges and no user interaction, and can be performed remotely over the network. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the InfiniteWP Client interface to trusted administrators only and monitor for suspicious activity. Avoid exposing the client to untrusted networks.