CVE-2023-2916: revmakx infinitewp_client Exposure of Resource to Wrong Sphere

Vulnerability summary

CVE-2023-2916 is a high (CVSS 7.5) Exposure of Resource to Wrong Sphere vulnerability in revmakx infinitewp_client. EPSS estimates a 23.99% chance of exploitation in the next 30 days, higher than 97.8% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 15-08-2023
   PublishedVulnerability first disclosed.
2. 08-04-2026
   Last modifiedVulnerability information updated.

Description

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.

• CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.