CVE-2020-8772: Revmakx Infinitewp Client

Critical severity, CVSS 9.8. EPSS: 88% chance of exploitation in the next 30 days.

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.

Affected products

• Revmakx Infinitewp Client: before 1.9.4.5 (fixed in 1.9.4.5)

Published 2020-02-06. Last modified 2026-06-17.