Vulnerability · Published Aug 15, 2023 · Assigned by Wordfence
CVE-2023-2916InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure
High 7.5
In plain English
A high-severity information exposure in InfiniteWP Client from revmakx. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 24.0% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| revmakx | InfiniteWP Client | 0 – through 1.11.1 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H