CVEs-PoC/2020/CVE-2020-8772.md

CVE-2020-8772

Description

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.

POC

Reference

• https://wpvulndb.com/vulnerabilities/10011

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/ChoiSG/vwp
• https://github.com/Elsfa7-110/kenzer-templates
• https://github.com/HycCodeQL/wordpress
• https://github.com/Irdinaaaa/pentest
• https://github.com/beardcodes/wordpress
• https://github.com/d4n-sec/d4n-sec.github.io
• https://github.com/ehsandeep/wordpress-application
• https://github.com/vavkamil/dvwp