CVE-2023-2916

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.

• CWE-200
• CWE-668

• https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.11.1/core.class.php#L365Exploit
• https://plugins.trac.wordpress.org/changeset/2925897/iwp-client#file4Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/aa157c80-447f-4406-9e49-9cc6208b7b19?source=cveExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/iwp-client/tags/1.11.1/core.class.php#L365Exploit
• https://plugins.trac.wordpress.org/changeset/2925897/iwp-client#file4Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/aa157c80-447f-4406-9e49-9cc6208b7b19?source=cveExploit, Third Party Advisory

Published

Aug 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29154SQL injection vulnerability exists in the CONPROSYS HMI Syst…7.2
• CVE-2023-29155Versions of INEA ME RTU firmware 3.36b and prior do not requ…9.8
• CVE-2023-29156DroneScout ds230 Remote ID receiver from BlueMark Innovation…6.8
• CVE-2023-29157Improper access control in some Intel(R) OFU software before…7.8
• CVE-2023-29158 SUBNET PowerSYSTEM Center versions 2020 U10 and prior are…9.1
• CVE-2023-29159Directory traversal vulnerability in Starlette versions 0.13…7.5
• CVE-2023-29160Stack-based buffer overflow vulnerability exists in FRENIC R…7.8
• CVE-2023-29161Uncontrolled search path in some Intel(R) OFU software befor…7.8
• CVE-2023-29162Improper buffer restrictions the Intel(R) C++ Compiler Class…6
• CVE-2023-29163 When UDP profile with idle timeout set to immediate or the …7.5
• CVE-2023-29164Improper access control in BMC Firmware for the Intel(R) Ser…7.3
• CVE-2023-29165Unquoted search path or element in some Intel(R) Arc(TM) Con…7.3