EUVD-2026-54882
GHSA-5r79-75x7-rrwq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated bind of the management endpoint needs no privileges or interaction (PR:N/UI:N/AC:L), yielding administrator control and RCE, so C/I/A are all High.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.
AnalysisAI
Full network takeover via authentication bypass in the InfiniteWP Client WordPress plugin before 1.13.6 affects WordPress Multisite installations, where the plugin fails to validate the site-connection state and the authenticity of requests to its remote-management endpoint. Unauthenticated remote attackers can bind their own management key, hijack an administrator session, and gain control of every site in the network, culminating in remote code execution. No public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) despite the maximal 9.8 CVSS, and a vendor patch is available.
Technical ContextAI
InfiniteWP Client is the agent-side WordPress plugin that pairs a site with a self-hosted InfiniteWP admin panel, exposing a remote-management endpoint that accepts privileged actions (updates, backups, user management) once a controller has been 'connected' by exchanging a key. The root cause is classed as CWE-287 (Improper Authentication): on Multisite deployments the plugin does not properly verify whether the site is already in a connected/pending state, nor does it authenticate the origin of requests to that endpoint, so an attacker can complete the key-binding handshake as if they were a legitimate controller. Because the management endpoint operates with network-superadmin capabilities on Multisite, a successful bind lets the attacker act as an administrator and pivot to code execution through normal plugin/theme-editing or update mechanisms.
RemediationAI
Upgrade the InfiniteWP Client plugin to version 1.13.6 or later on every WordPress site, which is the vendor-released fix and the definitive remediation (Patch: Available from vendor; see the WPScan advisory at https://wpscan.com/vulnerability/629d655f-cdb8-4733-81d5-12fa88c32bb6/). If immediate patching is not possible, deactivate and remove the InfiniteWP Client plugin from Multisite installations until it can be updated, accepting the trade-off that remote management via the InfiniteWP panel will stop working. As interim compensating controls, restrict access to the plugin's remote-management endpoint at the web-server or WAF layer to only the known IP address(es) of your InfiniteWP admin panel (side effect: management from any other network location will fail), and disconnect any sites that do not actually require InfiniteWP management. After patching, rotate the connection key and audit administrator accounts and recently installed plugins/themes for signs of an unauthorized bind.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today