CVE-2025-12137

1 Helper to call the plugin’s REST API with current nonce root@kitploit: async function iwpFetchpath, method='GET', body const nonce = window?.wpApiSettings?.nonce || jQuery?.ajaxSettings?.headers?.'X-WP-Nonce'; const res = await fetch$location.origin/wordpress/wp-json/iwp/v1$path, method, header...

CVE-2020-37255 WordPress Time Capsule Plugin 1.21.16 Authentication Bypass

WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWPJSONPREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies...

CVE-2020-37255

CVE-2020-37255 affects WordPress Time Capsule Plugin version 1.21.16. The vulnerability is an authentication bypass that lets unauthenticated attackers craft a POST request containing the IWP_JSON_PREFIX header to obtain a valid administrator session cookie and gain access to the WordPress dashbo...

MAL-2025-48448 Malicious code in isg-iwp-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd99ea1f73a0a8a60395dd908d6a970f8ab7861bec1eb627b70023c9716185ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-34855

Malicious code in isg-iwp-web-client npm...

CVE-2020-8772

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwpmmbsetrequest in init.php. Any attacker who knows the username of an administrator can log in...

CVE-2020-8771

The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWPJSONPREFIX causes the client to be logged in as the first account on the list of administrator accounts...