Vulnerability · Published Feb 20, 2024 · Assigned by Wordfence
CVE-2023-6565InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure
Medium 5.9
In plain English
A medium-severity security flaw in InfiniteWP Client from revmakx. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.6%top 49.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window of the backup process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| revmakx | InfiniteWP Client | 0 – through 1.12.3 |
Weakness: CWE-922 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N