CVE-2026-8685 is an SQL Injection vulnerability in the Infility Global WordPress plugin affecting all versions up to 2.15.16. The issue arises from improper neutralization of special elements in the 'orderby' and 'order' parameters within the show_control_data::post_list() function. This function is registered as an admin menu page accessible to users with at least Subscriber privileges. The vulnerability allows these authenticated users to inject additional SQL commands into existing queries, enabling unauthorized data extraction from the database. The CVSS 3.1 score of 6.5 reflects a medium severity with network attack vector, low attack complexity, and low privileges required.

Successful exploitation allows authenticated users with Subscriber-level access or higher to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive database information. There is no indication of impact on data integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for suspicious activity related to the 'orderby' and 'order' parameters in the Infility Global plugin. Avoid granting unnecessary privileges to untrusted users.