# MA-763.012020: MyCERT Advisory - Authentication Bypass in InfiniteWP Client plugin for WordPress

**Date:** 16 Jan 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-763.012020  
**Advisory ID:** MA-763.012020

---

**1.0 Introduction**
Recently, a vulnerability has been identified in one of the WordPress plugin known as InfiniteWP that would allow a remote attacker to bypass the authentication process. InfiniteWP is an open-source plugin where it is designed to allow user to manage unlimited number of WordPress sites from their own server.
**2.0 Impact**
In result of exploiting this vulnerability, it will allow remote attackers to bypass the authentication process and gain unauthorized access to the application.
**3.0 Affected Products**
- InfiniteWP Client version <= 1.9.4.4
**4.0 Recommendations**
InfiniteWP has released its latest patch and we highly recommend user to update in the **latest version 1.9.4.5** and may refer here: <https://wordpress.org/plugins/iwp-client/#installation>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://wpvulndb.com/vulnerabilities/10011/>
- <https://www.cybersecurity-help.cz/vdb/SB2020010902?affChecked=1>
- <https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/>
- <https://wordpress.org/plugins/iwp-client/#installation>