CVE-2016-15004

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to injection. The attack can be launched remotely. Upgrading to version 1.6.1.1 is able to address this issue. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
unspecified	InfiniteWP Client Plugin	1.5.1.3; 1.6.0

References

http://seclists.org/fulldisclosure/2017/Jan/72Exploit, Mailing List, Third Party Advisory
https://sumofpwn.nl/advisory/2016/infinitewp_client_wordpress_plugin_unauthenticated_php_object_injection_vulnerability.htmlExploit, Third Party Advisory
https://vuldb.com/?id.96073Third Party Advisory
http://seclists.org/fulldisclosure/2017/Jan/72Exploit, Mailing List, Third Party Advisory
https://sumofpwn.nl/advisory/2016/infinitewp_client_wordpress_plugin_unauthenticated_php_object_injection_vulnerability.htmlExploit, Third Party Advisory
https://vuldb.com/?id.96073Third Party Advisory

Timeline

Published: Jul 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-150058.8CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict CVE-2016-150065.3A vulnerability, which was classified as problematic, has been found in enigmaX up to 2.2. This issue affects the function getSeed of the fi CVE-2016-150079.8A vulnerability was found in Centralized-Salesforce-Dev-Framework. It has been declared as problematic. Affected by this vulnerability is th CVE-2016-150086.1A vulnerability was found in oxguy3 coebot-www and classified as problematic. This issue affects the function displayChannelCommands/display CVE-2016-150098.8A vulnerability classified as problematic has been found in OpenACS bug-tracker. Affected is an unknown function of the file lib/nav-bar.adp CVE-2016-15014.3ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors CVE-2016-150106.1** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in University of Cambridge django-ucamlookup up to 1.9.1 CVE-2016-150119.8A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSign CVE-2016-150129.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in forcedotcom SalesforceMobileSDK-Windows up to 4.x. It has been rated as critica CVE-2016-150139.8A vulnerability was found in ForumHulp searchresults. It has been rated as critical. Affected by this issue is the function list_keywords of CVE-2016-150145.5A vulnerability has been found in CESNET theme-cesnet up to 1.x on ownCloud and classified as problematic. Affected by this vulnerability is CVE-2016-150155.3A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the