Vulnerabilities

TI-2024-09807 CVE-2024-10585 · GHSA-4xwv-9wqw-54g9

InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading

LOW 31

The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/debug-chart/index.php file.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0067 Published 2025-01-08 No fix listed CWE-22

TI-2023-06016 CVE-2023-6565 · GHSA-f8g5-8cw5-cg9c

InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure

LOW 27

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00642 Published 2024-02-20 No fix listed CWE-922

TI-2023-02734 CVE-2023-2916 · GHSA-jm74-36vr-69gx

InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure

HIGH 66

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.23987 Published 2023-08-15 No fix listed CWE-200

TI-2016-09124 CVE-2016-15004 · GHSA-6645-42mw-qcmm

InfiniteWP Client Plugin injection

HIGH 81

A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01734 Published 2022-07-23 No fix listed CWE-74

TI-2020-07033 CVE-2020-8772 · GHSA-wv57-f2gm-36vc

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization…

HIGH 84

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.87677 Published 2020-02-06 No fix listed CWE-862