CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC The InfiniteWP Client plugin for WordPress, in versions up to and including 1.11.1, is vulnerable to a Sensitive Information Exposure flaw. This vulnerability allows authenticated attackers with subscriber-level permissions or above to extract sensitive data,...

By-Poloss..-..CVE-2026-15038-POC

🚨 CVE-2026-15038 — InfiniteWP Client 管理员接管 WordPress 多站点中未经身份验证的管理员账户接管 📋 概述 WordPress 的 InfiniteWP Client 插件（ 1.13.6）存在一个影响 多站点安装 的严重身份验证绕过漏洞。 未经过身份验证的攻击者可以： 🔓 绕过所有身份验证检查 🔑 绑定自己的加密密钥 👑 接管管理员会话 💻 实现远程代码执行 RCE 🌐 入侵整个 WordPress 网络 🔍 根本原因分析...

CVE-2026-17576

The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the getcomments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWPMMBComment::getcomments...

CVE-2026-17576

The InfiniteWP Client WordPress plugin (versions ≤ 1.13.9) is vulnerable to SQL Injection via the get_comments action. The root cause is insufficient escaping on JSON request-body array-key names: IWP_MMB_Comment::get_comments() strips the iwp_get_comments_ prefix from keys, wraps the remainder i...

CVE-2026-17576 InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key

The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the getcomments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWPMMBComment::getcomments...

EUVD-2026-82742

The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the getcomments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWPMMBComment::getcomments...

CVE-2026-74011

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

CVE-2026-74011 WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

EUVD-2026-63324

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

CVE-2026-74011

A Blind SQL Injection vulnerability exists in the InfiniteWP Client WordPress plugin by revmakx, affecting versions through 1.13.9 . The flaw stems from improper neutralization of special elements in SQL commands, allowing an authenticated attacker (high privileges required) to extract data from ...

WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin InfiniteWP Client versions = 1.13.9...

CVE-2026-15038

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038 InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

EUVD-2026-54882

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038

The CVE affects the InfiniteWP Client WordPress plugin (before 1.13.6). Root cause: it does not properly verify the site-connection state or the authenticity of requests to its remote-management endpoint on WordPress Multisite installations. Impact: unauthenticated attackers can bind their own ke...

EUVD-2016-2078

Malware in sbrugna...

EUVD-2024-33519

Malicious code in bioql PyPI...

EUVD-2023-58793

Malicious code in bioql PyPI...

InfiniteWP-exploit

It is an exploit module for InfiniteWP Client 1.9.4.5 - Authentication Bypass. The primary CVE ID is not explicitly stated, but the exploit is based on a vulnerability disclosed at https://0day.work/infinitewp-client-1-9-4-5-authentication-bypass/. The target product/service is InfiniteWP Client,...