CVE-2023-2916
Published: 15 August 2023
Summary
CVE-2023-2916 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Revmakx Infinitewp Client. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 3.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The InfiniteWP Client plugin for WordPress is affected by a sensitive information exposure vulnerability in versions up to and including 1.11.1. The flaw resides in the admin_notice function, which can leak configuration and other sensitive data when the plugin remains unconfigured. The issue is tracked under CWE-200 and CWE-668 and carries a CVSS 3.1 score of 7.5.
Authenticated attackers holding subscriber-level or higher privileges can exploit the exposure provided the plugin has never been set up. When chained with a separate flaw that permits arbitrary plugin installation and activation, an attacker may register the site with an InfiniteWP control server, enabling remote management and subsequent privilege escalation on the WordPress installation.
Public references, including Wordfence advisory data and WordPress plugin repository changesets, indicate that the vendor addressed the exposure in a subsequent release; site operators are expected to update the InfiniteWP Client plugin to a version newer than 1.11.1.
EPSS for the CVE currently stands at 0.295 with an identical recorded peak, indicating moderate but stable exploitation interest since disclosure. No confirmed in-the-wild campaigns have been reported in the supplied references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34362
Vulnerability details
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It…
more
can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Controls whether organization resources are exposed to external system spheres by permitting or prohibiting their use.
By enforcing authorization matching prior to sharing, the control reduces the risk of exposing sensitive information to unauthorized actors.
Review and removal of nonpublic information from publicly accessible systems directly prevents exposure of sensitive data to unauthorized actors.
Data mining protection mechanisms detect and block unauthorized bulk extraction of sensitive data, directly mitigating exposure to unauthorized actors.
Documenting information locations and authorized users enables better protection against unauthorized exposure of sensitive data.
Media marking ensures sensitive information on removable or system media is handled according to its classification, reducing the chance of inadvertent exposure to unauthorized actors.
Protecting and controlling media during external transport prevents exposure of sensitive information to unauthorized actors.
Assessing control effectiveness and providing incident communication channels at alternate sites reduces the likelihood of sensitive information exposure to unauthorized actors.