CVE-2026-7842 is a SQL injection vulnerability (CWE-89) in the Infility Global WordPress plugin versions prior to 2.15.20. The vulnerability arises because the plugin does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks. Authenticated attackers with Editor-level or higher privileges can exploit this flaw to perform time-based blind SQL injection attacks, potentially extracting sensitive data from the database. Exploitation requires the ImportData module to be enabled within the plugin. There is no CVSS score or vendor advisory indicating patch availability or remediation status.

An attacker with Editor-level or higher privileges can exploit this vulnerability to perform time-based blind SQL injection, allowing extraction of sensitive database information. This compromises data confidentiality and could lead to further attacks depending on the data accessed. The vulnerability requires the ImportData module to be enabled, limiting exposure to installations where this module is active.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Editor-level access to trusted users only and consider disabling the ImportData module if not required to reduce attack surface.