CVE-2023-2916

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.11.1/core.class.php#L365	Exploit
https://plugins.trac.wordpress.org/changeset/2925897/iwp-client#file4	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/aa157c80-447f-4406-9e49-9cc6208b7b19?source=cve	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:revmakx:infinitewp_client:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2023-08-15 09:15

Updated : 2023-11-07 04:13

NVD link : CVE-2023-2916

Mitre link : CVE-2023-2916

CVE.ORG link : CVE-2023-2916

JSON object : View

Products Affected

revmakx

infinitewp_client

CWE

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2023-2916", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2023-08-15T09:15:09.713", "references": [{"url": "https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.11.1/core.class.php#L365", "tags": ["Exploit"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/2925897/iwp-client#file4", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa157c80-447f-4406-9e49-9cc6208b7b19?source=cve", "tags": ["Exploit", "Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges."}, {"lang": "es", "value": "El plugin InfiniteWP Client para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en versiones hasta, e incluyendo, 1.11.1 a trav\u00e9s de la funci\u00f3n 'admin_notice'. Esto puede permitir a atacantes autenticados con permisos de nivel de suscriptor o superior extraer datos confidenciales, incluida la configuraci\u00f3n. S\u00f3lo puede ser explotada si el plugin no ha sido configurado todav\u00eda. Si se combina con otra vulnerabilidad de instalaci\u00f3n y activaci\u00f3n arbitraria de plugins, puede ser posible conectar un sitio a InfiniteWP, lo que har\u00eda posible la gesti\u00f3n remota y permitir\u00eda la elevaci\u00f3n de privilegios."}], "lastModified": "2023-11-07T04:13:32.660", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:revmakx:infinitewp_client:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "DA2C819A-AE97-4E6E-BD0B-A78EE7A01E26", "versionEndExcluding": "1.12.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}