CVE-2023-6565 InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure
Unauthenticated attackers can extract sensitive data from temporary SQL files during backup processes in the InfiniteWP Client plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6565?
CVE-2023-6565 is a medium-severity vulnerability in revmakx InfiniteWP Client, published on 20 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window of the backup process.
Weakness: CWE-922
Which versions are affected by CVE-2023-6565?
It affects 1 product.
Products include Revmakx Infinitewp Client.
How do I fix CVE-2023-6565?
No fix has been published for CVE-2023-6565 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-6565 being exploited?
There is no known exploitation of CVE-2023-6565 in the wild and no public exploit code.
Other vulnerabilities in revmakx InfiniteWP Client
- CVE-2020-8772 Missing authorization in n/a
- CVE-2023-2916 InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure
- CVE-2016-15004 InfiniteWP Client Plugin injection
- CVE-2024-10585 InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading
Sources
Also known as GHSA-f8g5-8cw5-cg9c.