WordPress Multisite InfiniteWP Client Authentication Bypass

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-15038 exploits a critical authentication flaw in the InfiniteWP Client plugin for WordPress Multisite installations. The vulnerability stems from improper verification of site-connection state and request authenticity on remote-management endpoints (CWE-287: Improper Authentication). This allows unauthenticated attackers to bind malicious API keys, hijack administrator sessions, and gain complete control over the entire WordPress network—ultimately enabling remote code execution. Any organization using InfiniteWP Client below version 1.13.6 on a Multisite installation faces severe risk, as the attack requires no credentials and can compromise all sites within the network simultaneously.

Casky's 283 matching security skills detect this vulnerability through Claude's extended reasoning across two critical MITRE ATT&CK techniques: TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using the platform would observe findings highlighting unauthenticated endpoint access patterns, anomalous key-binding requests lacking proper session validation, and suspicious authentication token generation without credential verification. The skill set identifies the characteristic behavior of attackers binding remote management keys without administrator approval, followed by lateral movement across the Multisite network. Security teams would see detection patterns correlating unauthorized API key creation, session hijacking indicators, and privilege escalation from anonymous user to network administrator—enabling rapid identification and response before RCE exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15038.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-15038

Casky has 283 skills that investigate the attack patterns behind CVE-2026-15038. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn