EUVD-2026-102303
GHSA-h84q-w98f-8x59
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged WordPress user
-
ExploitSend request to Infinite Uploads plugin endpoint
-
ExecutionReceive sensitive data embedded in response
-
ImpactHarvest exposed credentials/configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Requires an authenticated session on the target WordPress site (CVSS PR:L), so the attacker must already hold at least a low-privileged account; the flaw is remotely reachable over the network with no user interaction and low complexity against Infinite Uploads versions up to and including 3.4.1. The limiting factor is the authentication requirement - anonymous visitors cannot trigger it - which, combined with the plugin's modest deployment footprint, constrains realistic exposure. Exact feature/endpoint returning the sensitive data is not specified in the available description. |
| Impact | Signals are moderate and internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, low-privilege information disclosure with high confidentiality impact and no integrity or availability effect - consistent with CWE-201 (Insertion of Sensitive Information Into Sent Data). PR:L means some authenticated foothold is required, which meaningfully narrows the attacker population versus a PR:N flaw. EPSS, KEV, and SSVC data were NOT provided in the input, so exploitation probability and automatability cannot be quantified here. No public exploit identified at time of analysis, and there is no CISA KEV listing, so this is not confirmed active exploitation. Net: a legitimate confidentiality issue worth patching, but absent EPSS/KEV data and given the authentication requirement, it reads as a standard-priority plugin flaw rather than an emergency. The sole reference is a Patchstack database entry; no independent vendor advisory was supplied to corroborate affected-version boundaries. |
| Exploit ScenarioDerived | An attacker holding a low-privileged authenticated account on a WordPress site running Infinite Uploads ≤3.4.1 issues a request to a plugin endpoint that returns sensitive data embedded in its response (e.g. cloud storage credentials or configuration). No public proof-of-concept was identified. The low attack complexity means a single crafted request over the network is sufficient once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Sensitive data exposure in ClikIT's Infinite Uploads WordPress plugin (all versions through 3.4.1) lets an attacker who already holds a low-privileged account on the site cause embedded secrets to be returned in outbound responses. Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is remotely reachable with low complexity and no user interaction, but the PR:L metric means an authenticated session is a hard prerequisite - anonymous visitors cannot trigger it - so confidentiality is fully impacted while integrity and availability are untouched. Severity is moderate (CVSS 6.5); there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, and the exact endpoint or feature that emits the sensitive data is not disclosed in the available advisory.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to check the WordPress.org plugin page and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/infinite-uploads/vulnerability/wordpress-infinite-uploads-plugin-3-4-1-sensitive-data-exposure-vulnerability) for a corrected release and update Infinite Uploads as soon as one is published; if a newer version than 3.4.1 appears, upgrading past 3.4.1 is the fix. Until a patched build is confirmed, deactivating the plugin removes the exposure entirely at the cost of losing its upload/offload functionality - a reasonable trade-off where the plugin is non-essential. Because exploitation requires an authenticated low-privileged account (CVSS PR:L), the highest-value compensating control is entitlement reduction: audit the site's user roster and role assignments, remove or downgrade dormant subscriber/contributor accounts, and block self-registration or require approval if open sign-up is enabled, which directly shrinks the population that can reach the vulnerable path; expect this to be operationally disruptive on membership or multi-author sites where low-privileged accounts are the norm. Complement that with capability auditing (any plugin endpoint should require a capability appropriate to the data it returns, not a bare is_user_logged_in() check), logging and review of plugin AJAX/REST requests from low-privileged accounts, and egress monitoring for plugin responses containing credentials. If secrets such as API keys, tokens, or storage credentials may already have been returned to untrusted users, rotate them. Generic WAF signatures are of limited value here since the requests are authenticated and legitimate-looking, so they should be treated as detection rather than prevention.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-201, Insertion of Sensitive Information Into Sent Data: rather than a memory-safety or injection bug, this is a data-handling defect where the plugin includes sensitive values in a response it sends to the client (for example, in an AJAX, REST, or rendered page payload), so the data crosses a trust boundary even though the code path itself works as designed. The affected component is the WordPress plugin Infinite Uploads, tracked by the CPE cpe:2.3:a:clikit:infinite_uploads:*:*:*:*:*:*:*:* - an unversioned wildcard for the ClikIT product 'infinite_uploads', meaning every published release up to and including 3.4.1 falls in scope under this record; the '*' version field is a reminder that the CPE does not itself pin a lower bound, so the affected window is defined by the vendor/source advisory ('from n/a through 3.4.1'). Because WordPress plugins run in the same PHP process as the host application and typically reach the network through plugin-defined REST routes, admin-ajax actions, or shortcode/page output, this class of bug is exploited entirely at the application layer over HTTP: the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates a network-reachable endpoint, no attack complexity or user-interaction hurdle, and a requirement that the caller already be authenticated with at least low privileges. Scope is unchanged (S:U), so the leak is confined to the plugin's own security authority and does not by itself escalate into compromise of the underlying WordPress core; the whole risk therefore turns on what secrets the plugin transmits and how broadly subscriber-level accounts are handed out on a given site.
Know when Infinite Uploads gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable disclosure requiring a low-privileged authenticated account (PR:L), no user interaction, high confidentiality impact only; integrity and availability unaffected.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB