Skip to content
OpenAdvisories

Archive

9 August 2026

Vulnerabilities first published on this day (UTC), newest first.

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-15038 Public exploit

    InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite

    The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their o…