CVE-2023-2916

Katalog CVE

CVSS 5.3 · Medium EPSS 24,0%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada revmakx infinitewp client. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.

Rincian

Terbit di NVD

15 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

24,0% peluang dieksploitasi; lebih tinggi dari 97,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/2925897/iwp-client#file4 patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/aa157c80-447f-4406-9e49-9cc6208b7b19?source=cve exploit · advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.11.1/core.class.php#L365 exploit