CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC WordPress 的 InfiniteWP Client 插件（版本至 1.11.1 及包括该版本）存在敏感信息泄露漏洞。该漏洞允许具有订阅者级别或更高权限的已认证攻击者提取包含配置详细信息在内的敏感数据。利用此漏洞的前提是插件尚未进行过配置。当与另一个任意插件安装和激活漏洞结合使用时，可能导致对站点的远程管理以及潜在的权限提升。...

By-Poloss..-..CVE-2026-15038-POC

🚨 CVE-2026-15038 — InfiniteWP Client 管理员接管 WordPress 多站点中未经身份验证的管理员账户接管 📋 概述 WordPress 的 InfiniteWP Client 插件（ 1.13.6）存在一个影响 多站点安装 的严重身份验证绕过漏洞。 未经过身份验证的攻击者可以： 🔓 绕过所有身份验证检查 🔑 绑定自己的加密密钥 👑 接管管理员会话 💻 实现远程代码执行 RCE 🌐 入侵整个 WordPress 网络 🔍 根本原因分析...

CVE-2026-74011

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

CVE-2026-74011 WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

CVE-2026-74011

A Blind SQL Injection vulnerability exists in the InfiniteWP Client WordPress plugin by revmakx, affecting versions through 1.13.9 . The flaw stems from improper neutralization of special elements in SQL commands, allowing an authenticated attacker (high privileges required) to extract data from ...

EUVD-2026-63324

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin InfiniteWP Client versions = 1.13.9...

CVE-2026-15038

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038 InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038

The CVE affects the InfiniteWP Client WordPress plugin (before 1.13.6). Root cause: it does not properly verify the site-connection state or the authenticity of requests to its remote-management endpoint on WordPress Multisite installations. Impact: unauthenticated attackers can bind their own ke...

EUVD-2026-54882

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

EUVD-2016-2078

Malware in sbrugna...

EUVD-2024-33519

Malicious code in bioql PyPI...

EUVD-2023-58793

Malicious code in bioql PyPI...

InfiniteWP-exploit

It is an exploit module for InfiniteWP Client 1.9.4.5 - Authentication Bypass. The primary CVE ID is not explicitly stated, but the exploit is based on a vulnerability disclosed at https://0day.work/infinitewp-client-1-9-4-5-authentication-bypass/. The target product/service is InfiniteWP Client,...

CVE-2024-10585

The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the /debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files outside of the intended directory...

CVE-2023-6565

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET...

CVE-2023-2916

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'adminnotice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. ...

CVE-2020-8772

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwpmmbsetrequest in init.php. Any attacker who knows the username of an administrator can log in...