CVE-2023-2916 PoC — InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure

Source

https://github.com/d0rb/CVE-2023-2916

Associated Vulnerability

Title:InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure (CVE-2023-2916)
Description:The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.

Description

CVE-2023-2916 PoC

Readme

# CVE-2023-2916
CVE-2023-2916 PoC
The InfiniteWP Client plugin for WordPress, in versions up to and including 1.11.1, is vulnerable to a Sensitive Information Exposure flaw. This vulnerability allows authenticated attackers with subscriber-level permissions or above to extract sensitive data, including configuration details. Exploitation of this vulnerability is only possible if the plugin has not been configured previously. When combined with another arbitrary plugin installation and activation vulnerability, it may lead to remote management of the site and potential elevation of privileges.

File Snapshot


 [4.0K]  /data/pocs/cf660d6105f5833b29855c216b7e9ac953b49857
├── [1.1K]  PoC.py
└── [ 600]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!