Information disclosure in Revmakx Infinitewp Client
CVE-2023-2916
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.
Vulnerability class: Information Disclosure
EPSS: 0.240 (97.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Revmakx Infinitewp Client — versions 0
- Revmakx Infinitewp_client
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@wordfence.com (Exploit, Third Party Advisory)
- security@wordfence.com (Exploit)
- security@wordfence.com (Patch)
Frequently asked questions
- What is CVE-2023-2916?
- CVE-2023-2916 is a high-severity vulnerability in Revmakx Infinitewp Client, classified under Information Disclosure. CVSS score: 7.5/10. Published 2023-08-15.
- How severe is CVE-2023-2916?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-2916 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.