Critical severity9.8NVD Advisory· Published Feb 6, 2020· Updated Jun 17, 2026

CVE-2020-8772

Description

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.

Affected products

Revmakx/Infinitewp Client
cpe:2.3:a:revmakx:infinitewp_client:*:*:*:*:*:wordpress:*:*
Range: <1.9.4.5
WordPress/InfiniteWP Client plugindescription
WordPress/InfiniteWP Clientllm-fuzzy
Range: <1.9.4.5

Patches

Vulnerability mechanics

References

www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/nvdExploitThird Party Advisory
wpvulndb.com/vulnerabilities/10011nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.070
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000