CVE-2020-8772
CVE-2020-8772
Vexday Risk Score
40Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 87.9%KEV nãoPoC —Nuclei simMetasploit simPatch —
Lifecycle
14 Jan 2020Metasploit module available
06 Feb 2020Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.
Affected products
n/a · n/a