PT-2020-20264

Name of the Vulnerable Software and Affected Versions: InfiniteWP Client plugin versions prior to 1.9.4.5 Description: The InfiniteWP Client plugin for WordPress has a missing authorization check in the iwp mmb set request function within the init.php file. An attacker who knows an administrator'...

200K WordPress Sites Vulnerable to Plugin Flaw

A high-severity vulnerability exists in a popular WordPress plugin, potentially opening up 200,000 websites to takeover. The WordPress plugin in question in Code Snippets, which allows users to run small chunks of PHP code on their websites. This can be used to extend the functionality of the...

InfiniteWP Client Plugin for WordPress < 1.9.4.5 Authentication Bypass

The WordPress InfiniteWP Client Plugin installed on the remote host is affected by an authentication bypass vulnerability due to logical error. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

WordPress InfiniteWP Client Authentication Bypass

Exploit Title: Wordpress Plugin InfiniteWP Client 1.9.4.5 - Authentication Bypass Date: 2020-1-16 Exploit Author: Raphael Karger Vendor Homepage: https://infinitewp.com/ Version: InfiniteWP Client 1.9.4.5 !/usr/bin/python3 import requests import json import argparse import base64 import json impo...

WordPress Plugin InfiniteWP Client 1.9.4.5 - Authentication Bypass

Exploit Title: Wordpress Plugin InfiniteWP Client 1.9.4.5 - Authentication Bypass Date: 2020-1-16 Exploit Author: Raphael Karger Vendor Homepage: https://infinitewp.com/ Version: InfiniteWP Client 1.9.4.5 !/usr/bin/python3 import requests import json import argparse import base64 import json impo...

Wordpress InfiniteWP Client Plugin 1.9.4.5 - Authentication Bypass Exploit

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin InfiniteWP Client 1.9.4.5 - Authentication Bypass Exploit Author: Raphael Karger Vendor Homepage: https://infinitewp.com/ Version: InfiniteWP Client 1.9.4.5 !/usr/bin/python3 import requests import json import...

Wordpress Plugin InfiniteWP Client 1.9.4.5 - Authentication Bypass

Wordpress Plugin InfiniteWP Client 1.9.4.5 - Authentication Bypass Exploit Title: Wordpress Plugin InfiniteWP Client 1.9.4.5 - Authentication Bypass Date: 2020-1-16 Exploit Author: Raphael Karger Vendor Homepage: https://infinitewp.com/ Version: InfiniteWP Client 1.9.4.5 !/usr/bin/python3 import...

WordPress Plugin Time Capsule 1.21.16 - Authentication Bypass

Exploit Title: Wordpress Time Capsule Plugin 1.21.16 - Authentication Bypass Date: 2020-01-16 Exploit Author: B. Canavate Vendor Homepage: https://wptimecapsule.com/ Software Link: https://wptimecapsule.com/ Version: Wordpress Time Capsule Plugin 1.21.16 Tested on: LAMP stack with most recent...

Critical WordPress Bug Leaves 320,000 Sites Open to Attack

Two WordPress plugins, InfiniteWP Client and WP Time Capsule, suffer from the same critical authorization bypass bug that allows adversaries to access a site’s backend with no password. All an attacker needs is the admin username for the WordPress plugins and they are in, according to researchers...

WordPress InfiniteWP Client Authentication Bypass

This module exploits an authentication bypass in the WordPress InfiniteWP Client plugin to log in as an administrator and execute arbitrary PHP code by overwriting the file specified by PLUGINFILE. The module will attempt to retrieve the original PLUGINFILE contents and restore them after payload...

InfiniteWP Client < 1.9.4.5 - Authentication Bypass

As per agreement between the researcher and developer, details will be released on January 14th. It is possible to login as any administrator on the site due to logical mistakes in the code. The issue resides in the function iwpmmbsetrequest which is located in the init.php file. This checks if t...

WordPress InfiniteWP Client plugin <= 1.9.4.4 - Authentication Bypass vulnerability

Authentication Bypass vulnerability found by WebARX in WordPress InfiniteWP Client plugin versions = 1.9.4.4. Solution Update the WordPress InfiniteWP Client plugin to the latest available version at least 1.9.4.5...

WordPress InfiniteWP Client 1.5.1.3 / 1.6.0 PHP Object Injection Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------ InfiniteWP Client WordPress Plugin unauthenticated PHP Object injection vulnerability ------------------------------------------------------------------------ Yorick...

InfiniteWP Client <= 1.6.0 - Unauthenticated PHP Object Injection

The InfiniteWP Client WordPress plugin was affected by an Unauthenticated PHP Object Injection security vulnerability...

WordPress InfiniteWP Admin Panel Authentication Bypass Vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An authentication bypass vulnerability exists in the WordPress InfiniteWP Admin Panel. Because app/php does n...

WordPress InfiniteWP Admin Panel Command Injection Vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A command injection vulnerability exists in WordPress InfiniteWP Admin Panel. An attacker can exploit the...

WordPress InfiniteWP Admin Panel 2.8.0 Command Injection

------------------------------------------------------------------------ Command injection in InfiniteWP Admin Panel ------------------------------------------------------------------------ Sipke Mellema, July 2016 ------------------------------------------------------------------------ Abstract...

WordPress InfiniteWP Admin Panel 2.8.0 Authorization Bypass

------------------------------------------------------------------------ Authorization bypass in InfiniteWP Admin Panel ------------------------------------------------------------------------ Sipke Mellema, July 2016 ------------------------------------------------------------------------ Abstra...

InfiniteWP Admin Panel 2.8.0 - authorization bypass

InfiniteWP Admin Panel version 2.8.0 has vulnerable authentication method. Solution Update InfiniteWP Admin Panel plugin at least to 2.9.0 version...

InfiniteWP Client <= 1.3.14 - Unspecified Critical

The InfiniteWP Client WordPress plugin was affected by an Unspecified Critical security vulnerability...