CVE-2020-8772
CRITICAL NUCLEIInfiniteWP Client <1.9.4.5 - Privilege Escalation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-8772.
PoCs published by WebARX, wvu, including Metasploit module exploits/unix/webapp/wp_infinitewp_auth_bypass.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits an authentication bypass in the WordPress InfiniteWP Client plugin (CVE-2020-8772) to log in as an administrator and execute arbitrary PHP code by overwriting a specified plugin file. It includes functionality to restore the original file contents post-exploitation.
Description
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.
Exploits (1)
This Metasploit module exploits an authentication bypass in the WordPress InfiniteWP Client plugin (CVE-2020-8772) to log in as an administrator and execute arbitrary PHP code by overwriting a specified plugin file. It includes functionality to restore the original file contents post-exploitation.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H