CVE-2023-6565CWE-922

InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure

Medium · published February 20, 2024

CVSS v3.1
5.9
EPSS
1%
Percentile
50.1
In the wild
Unconfirmed
What it is

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window of the backup process.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00642 · 50.1th percentile
Weakness
CWE-922 · Insecure Storage of Sensitive Information
Published
2024-02-20T18:56Z
EPSS history
Timeline
  • 20 FEB 18:56Z
    InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure
    cvelistv5