CVE-2023-2916

Summary

CVE-2023-2916 is a vulnerability affecting the InfiniteWP Client plugin for WordPress. This issue, which can be exploited by authenticated attackers with subscriber-level access or higher, involves sensitive information exposure through the 'admin_notice' function. The flaw allows the extraction of configuration data, but only if the plugin has not been configured yet. If an arbitrary plugin installation and activation vulnerability is present, an attacker could connect a site to InfiniteWP, leading to remote management and potential privilege escalation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.