published February 6, 2020
NVD has not assigned a CVSS score to this record. It sits in the 99.8th percentile for exploit probability.
⚠️ A missing authorization check in the InfiniteWP Client plugin means anyone with your admin username can log in — no magic password required! 🔑 Think of it like a VIP event where the bouncer only checks the name on the guest list, not the ID. If someone knows the name of an admin, they can just walk right in and enjoy all the privileges! This could lead to unauthorized access to your entire WordPress site. An attacker could change settings, install malicious plugins, or even wipe out your data in an absolute disaster! ⏳
Think of it like a VIP event where the bouncer only checks the name on the guest list, not the ID. If someone knows the name of an admin, they can just walk right in and enjoy all the privileges! The vulnerability in InfiniteWP Client plugin version 1.9.4.5 and earlier allows attackers to bypass the authorization check in the iwp_mmb_set_request function, enabling access if they know the admin's username.
This could lead to unauthorized access to your entire WordPress site. An attacker could change settings, install malicious plugins, or even wipe out your data in an absolute disaster! ⏳ Update the InfiniteWP Client plugin to version 1.9.4.5 or later immediately. Review user account security and consider implementing two-factor authentication to further protect against unauthorized access. You've got this! Stay vigilant, update those plugins, and keep your site secure! 🛡️