Infility Global Security & Risk Analysis

The "infility-global" plugin v2.14.61 exhibits a concerning security posture, largely due to its significant number of unprotected entry points and a history of numerous vulnerabilities. While the plugin utilizes prepared statements for a majority of its SQL queries and has a reasonable rate of output escaping, these positive aspects are overshadowed by critical weaknesses. The static analysis reveals a large attack surface with 35 out of 42 entry points lacking authentication checks, a major red flag for potential unauthorized access and actions. The presence of the `unserialize` function, even if only one, is a known risk for deserialization vulnerabilities if not handled with extreme care and input validation.

The vulnerability history is particularly alarming. With 10 known CVEs, 6 of which are currently unpatched, and a significant portion being high severity, this plugin has a demonstrated track record of being insecure. The common vulnerability types like SQL Injection, Path Traversal, XSS, and Missing Authorization directly correlate with the identified weaknesses in the static analysis, such as unprotected AJAX handlers and the potential for unsanitized input. The last vulnerability being in February 2026, while in the future, is likely a data artifact and indicates a recent history of exploitation.

In conclusion, despite some good practices in SQL and output handling, the "infility-global" plugin has a high-risk profile. The extensive unprotected attack surface, coupled with a persistent history of serious, unpatched vulnerabilities, makes it a significant liability for any WordPress site. Users should strongly consider disabling or replacing this plugin until these critical issues are addressed.