PT-2022-7847 · WordPress · Infinitewp Client Plugin

Yorick Koster · Published 2022-07-23 · Updated 2022-07-29 · CVE-2016-15004

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InfiniteWP Client Plugin versions 1.5.1.3 through 1.6.0

Description A critical issue has been found, affecting an unknown functionality, which leads to injection when manipulated. The attack can be launched remotely.

Recommendations For InfiniteWP Client Plugin versions 1.5.1.3 through 1.6.0, upgrade to version 1.6.1.1 to address this issue.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2016-15004

Affected Products

Infinitewp Client Plugin

References · 6

• 🔥 https://sumofpwn.nl/advisory/2016/infinitewp_client_wordpress_plugin_unauthenticated_php_object_injection_vulnerability.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2017/Jan/72 · Exploit
• https://osv.dev/vulnerability/CVE-2016-15004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-15004 · Security Note
• https://t.me/cvenotify/33667 · Telegram Post
• https://vuldb.com/?id.96073 · Note