PT-2023-22177 · WordPress · Infinitewp Client
István Márton
+1
·
Publicado
2023-08-15
·
Atualizado
2023-08-21
·
CVE-2023-2916
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
InfiniteWP Client plugin for WordPress versions up to, and including, 1.11.1
Description
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure via the
admin notice function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.Recommendations
For InfiniteWP Client plugin for WordPress versions up to, and including, 1.11.1, consider configuring the plugin as soon as possible to prevent exploitation. As a temporary workaround, consider restricting access to the
admin notice function until a patch is available. Additionally, be cautious of arbitrary plugin installation and activation vulnerabilities that could be combined with this issue to elevate privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Exposure of Resource to Wrong Sphere
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Infinitewp Client