CVE-2020-28642: Infinitewp

Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days.

In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attackers to conduct admin Account Takeover attacks.

Affected products

• Infinitewp Infinitewp: before 3.1.12.3 (fixed in 3.1.12.3)

Published 2020-11-16. Last modified 2026-06-17.