Infinitewp Client
Monthly
Blind SQL Injection in the InfiniteWP Client WordPress plugin (revmakx) through version 1.13.9 allows high-privileged authenticated attackers to exfiltrate database contents via crafted network requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection reaches beyond the WordPress application boundary into the underlying database layer, enabling extraction of sensitive stored data including credentials and application records. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though Patchstack's disclosure confirms it is reproducible.
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/debug-chart/index.php file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 29.5%.
Blind SQL Injection in the InfiniteWP Client WordPress plugin (revmakx) through version 1.13.9 allows high-privileged authenticated attackers to exfiltrate database contents via crafted network requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection reaches beyond the WordPress application boundary into the underlying database layer, enabling extraction of sensitive stored data including credentials and application records. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though Patchstack's disclosure confirms it is reproducible.
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/debug-chart/index.php file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 29.5%.