CVE-2026-15038

CVE-2026-15038 in the InfiniteWP plugin is a critical authentication bypass that merits your immediate attention, especially if you operate WordPress Multisite. The vulnerability allows unauthenticated attackers to bind their own key to your InfiniteWP installation, which in a standard single-site deployment grants them administrator-level access to that site. In Multisite, the blast radius is fundamentally different—the InfiniteWP management endpoint operates at the network level, controlling every site under your installation from a single console. An attacker binding their key doesn't just own one site; they own the management plane that can push plugin installations, theme changes, or arbitrary code execution across your entire network simultaneously. The vulnerability exists in the remote-management endpoint that InfiniteWP uses to communicate with its parent server. The critical failure is the absence of connection-state verification—requests to bind a new key were accepted without validating whether they originated from your legitimate InfiniteWP server versus an external attacker. WordPress's native authentication session mechanics authenticate a user identity but don't encode the network-level trust context that Multisite introduces. The result is that a key-binding attack bypasses both site-level authentication and network-level capability checks because the endpoint never interrogated which trust layer the request was operating in. Version 1.13.6 contains the fix, and you should upgrade immediately. However, the patch delta question matters: if the fix was merely request signing without connection-state enforcement, the architectural exposure remains for comparable remote-management plugins. The Multisite attack surface creates a topology where compromise of the central management layer collapses the isolation model entirely—you don't need to chain exploits across hundreds of sites, you need to own one endpoint that was never designed to enforce network-level trust context. Operational priority: isolate your InfiniteWP management plane to minimum necessary network exposure, ideally restricting it to IPs that reach your InfiniteWP server. Monitor for unexpected key-binding activity in your logs. If you're running Multisite with any remote-management plugin, treat the management plane as your highest-value target—it sits outside the site-level security model and owns everything underneath it.

Reviewed through automated stages and approved by a human before publication.