CVE•Published 2023-08-15•Modified 2026-04-08•1 article on news•5 live references•NVD data

CVE-2023-2916Revmakx · Infinitewp_client

Vulnerability data via NVD (ingested)

CVSS v3.1

7.5

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 3% of all CVEs

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized Actor CWE-668Exposure of Resource to Wrong Sphere

Description

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.

Timeline

Published 2023-08-15

Modified 2026-04-08

External references

NVD MITRE Exploit-DB trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2023-2916

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · WP plugin path

http.html:"/wp-content/plugins/infinitewp-client/"

Matches any site loading the "infinitewp-client" plugin — doesn't rely on Shodan's vuln tag.

Shodan · product

product:"Revmakx Infinitewp Client"

All exposed Revmakx Infinitewp Client instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Infinitewp Client"

HTTP body or banner mentions "Infinitewp Client" — catches deploys Shodan didn't identify as a product.