CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window of the backup process.
Explanation of Vulnerability in Simple Terms
InfiniteWP Client versions up to 1.12.3 contain a vulnerability that allows an attacker to read sensitive information without authentication. The vulnerability requires specific network conditions to exploit but does not require user interaction. No integrity or availability impact occurs. Update to a version newer than 1.12.3 to remediate.
What an attacker can do
Read sensitive data from the InfiniteWP Client without authentication.
Potential impact on your site
Sensitive information stored in or accessible via InfiniteWP Client may be exposed to unauthenticated attackers.
Conditions required to exploit
Network access to the affected InfiniteWP Client installation; specific attack complexity conditions must be met.
Key dates
External resources
Related vulnerabilities
