Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2023-2916 EUVD-2023-34362GHSA-jm74-36vr-69gx

InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure

Published Aug 15, 2023 · Updated Apr 8, 2026 · Assigned by Wordfence

Vendor: revmakx Product: InfiniteWP Client Category: Web / CMS

Description

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.

Affected products

VendorProductAffectedFixed
revmakx InfiniteWP Client ≤ 1.11.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References