What is CVE-2020-8772?

CVE-2020-8772 is a vulnerability in N/a. Published 2020-02-06.

Is CVE-2020-8772 known to be exploited?

13 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in N/a

CVE-2020-8772

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.

EPSS: 0.936 (99.8th percentile) — read the EPSS interpretation.

Affected products

N/a — versions n/a

Public proof-of-concept exploits

rapid7/metasploit-framework
20142995/nuclei-templates
ARPSyndicate/cvemon
ARPSyndicate/kenzer-templates
ChoiSG/vwp
Elsfa7-110/kenzer-templates
HycCodeQL/wordpress
Irdinaaaa/pentest
beardcodes/wordpress
d4n-sec/d4n-sec.github.io

References

wpvulndb.com/vulnerabilities/10011 (x_refsource_MISC)
www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ (x_refsource_MISC)

Frequently asked questions

What is CVE-2020-8772?: CVE-2020-8772 is a vulnerability in N/a. Published 2020-02-06.
Is CVE-2020-8772 known to be exploited?: 13 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.