📄 Description (English)
The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action in all versions up to, and including, 2.14.46. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append - with certain server configurations - additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
🤖 AI Executive Summary
The Infility Global WordPress plugin contains an unauthenticated SQL injection vulnerability in the 'infility_get_data' API action affecting versions up to 2.14.46. Attackers can exploit insufficient input escaping to extract sensitive database information without authentication. This poses a critical risk to WordPress installations in Saudi Arabia, particularly those handling customer data or integrated with business systems.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 2, 2026 00:54
🇸🇦 Saudi Arabia Impact Assessment
High impact on Saudi e-commerce platforms, government websites using WordPress, healthcare portals, and financial services websites. Banking sector (SAMA-regulated entities) faces significant risk if WordPress is used for customer-facing applications. Telecom companies (STC, Mobily) and retail organizations using Infility Global plugin are particularly vulnerable. Government agencies under NCA oversight could face data breach incidents affecting citizen information. The vulnerability allows extraction of customer PII, financial records, and authentication credentials.
🏢 Affected Saudi Sectors
E-commerce and Retail
Banking and Financial Services
Government and Public Administration
Healthcare and Medical Services
Telecommunications
Hospitality and Tourism
Education
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
8.2
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Identify all WordPress installations using Infility Global plugin via plugin audit
2. Disable the plugin immediately if version 2.14.46 or earlier is detected
3. Review database access logs for suspicious 'infility_get_data' API calls with SQL syntax patterns
PATCHING:
1. Update Infility Global plugin to version 2.14.47 or later immediately
2. Ensure WordPress core and all dependencies are fully patched
3. Test updates in staging environment before production deployment
COMPENSATING CONTROLS (if immediate patching not possible):
1. Implement Web Application Firewall (WAF) rules to block requests containing SQL keywords in 'infility_get_data' parameters
2. Restrict API endpoint access via IP whitelisting to trusted sources only
3. Disable REST API if not required: add 'define('REST_API_ENABLED', false);' to wp-config.php
4. Implement rate limiting on API endpoints
DETECTION:
1. Monitor for requests to /wp-json/infility/v1/get_data with SQL syntax (UNION, SELECT, DROP, etc.)
2. Alert on database queries containing unexpected UNION statements or multiple SELECT clauses
3. Review WordPress error logs for database connection errors from API calls
4. Implement IDS signatures for SQL injection patterns in API parameters
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تحديد جميع تثبيتات WordPress التي تستخدم مكون Infility Global من خلال تدقيق المكونات
2. تعطيل المكون فوراً إذا تم اكتشاف الإصدار 2.14.46 أو الإصدارات الأقدم
3. مراجعة سجلات الوصول إلى قاعدة البيانات للبحث عن استدعاءات API المريبة 'infility_get_data' التي تحتوي على أنماط بناء جملة SQL
التصحيح:
1. تحديث مكون Infility Global إلى الإصدار 2.14.47 أو أحدث فوراً
2. التأكد من أن WordPress الأساسي وجميع التبعيات مصححة بالكامل
3. اختبار التحديثات في بيئة التجريب قبل نشرها في الإنتاج
الضوابط البديلة (إذا لم يكن التصحيح الفوري ممكناً):
1. تنفيذ قواعد جدار حماية تطبيقات الويب (WAF) لحجب الطلبات التي تحتوي على كلمات SQL في معاملات 'infility_get_data'
2. تقييد الوصول إلى نقطة نهاية API عبر قائمة بيضاء للعناوين الموثوقة فقط
3. تعطيل REST API إذا لم تكن مطلوبة
4. تنفيذ تحديد معدل على نقاط نهاية API
الكشف:
1. مراقبة الطلبات إلى /wp-json/infility/v1/get_data التي تحتوي على بناء جملة SQL
2. التنبيه على استعلامات قاعدة البيانات التي تحتوي على عبارات UNION غير متوقعة
3. مراجعة سجلات أخطاء WordPress لأخطاء اتصال قاعدة البيانات من استدعاءات API
4. تنفيذ توقيعات IDS لأنماط حقن SQL في معاملات API
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.14.2.1 - Information security requirements for supplier relationships
ECC 2024 A.12.6.1 - Management of technical vulnerabilities
ECC 2024 A.12.2.1 - Establishment of information security baselines
ECC 2024 A.14.1.1 - Information security policy for supplier relationships
🔵 SAMA CSF
SAMA CSF ID.BE-1 - Business Environment
SAMA CSF PR.AC-1 - Access Control
SAMA CSF PR.DS-2 - Data Security
SAMA CSF DE.CM-1 - Detection and Analysis
🟡 ISO 27001:2022
ISO 27001:2022 A.5.23 - Information security for supplier relationships
ISO 27001:2022 A.8.1 - Organizational controls
ISO 27001:2022 A.8.2 - Mobile device and teleworking
ISO 27001:2022 A.12.6 - Management of technical vulnerabilities
🟣 PCI DSS v4.0.1
PCI DSS 6.2 - Security patches and updates
PCI DSS 6.5.1 - Injection flaws
PCI DSS 11.3 - Penetration testing
🔗 References & Sources 4
🔗
🔗
🔗
🔗
https://plugins.trac.wordpress.org/browser/infility-global/trunk/include/class/db.class...
security@wordfence.com
https://plugins.trac.wordpress.org/browser/infility-global/trunk/include/class/str.clas...
security@wordfence.com
https://plugins.trac.wordpress.org/browser/infility-global/trunk/infility_global.php?ma...
security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/648941b8-d1ab-4587-bd87-f2300...
security@wordfence.com