CVE-2023-6565: falha de média gravidade em revmakx InfiniteWP Client
InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 0.6%
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window of the backup process.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
revmakx · InfiniteWP ClientCVEs relacionadas — revmakx InfiniteWP Client
No mesmo produto, das mais perigosas para as menos.
CVE-2023-2916HIGHInfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information ExposureEPSS 24.0%CVE-2024-10585MEDIUMInfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File ReadingEPSS 0.7%CVE-2026-17576MEDIUMInfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array KeyEPSS 0.5%CVE-2026-74011HIGHWordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerabilityEPSS 0.4%