InfiniteWP Client

InfiniteWP Client has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; all 10 are fixed as of October 2026. Their average CVSS score is 7.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 4 critical and 2 high. 2026 was the busiest year with 3 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 2 of the records (20%). Other recurring categories include Missing Authorization, SQL Injection.

Every one of the 10 issues recorded for InfiniteWP Client has a vendor fix available, so running the current release closes all known holes.

9 independent researchers contributed these findings, most of them (2) reported by Marc-Alexandre Montpas. InfiniteWP Client is installed on roughly 200,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.

Strategic Overview

Avg CVSSHigh

7.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all InfiniteWP Client vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2020-8772

InfiniteWP Client <= 1.9.4.4 - Authentication Bypass

Read the full analysis

Vulnerability Records

10 records


2026-09-17 18:35	InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key InfiniteWP Client <= 1.13.9	`CVE-2026-17576`	6.5 Medium	Wordfence PRISM	Yes
2026-08-20 00:00	InfiniteWP Client <= 1.13.9 - Authenticated (Administrator+) SQL Injection InfiniteWP Client <= 1.13.9	`CVE-2026-74011`	4.9 Medium	Ananda Dhakal	Yes
2026-08-04 00:00	InfiniteWP Client <= 1.13.5 - Unauthenticated Administrator Account Takeover on Multi-Site InfiniteWP Client <= 1.13.5	`CVE-2026-15038`	8.1 High	Jakub Herman	Yes
2025-01-07 00:00	InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading InfiniteWP Client <= 1.13.0	`CVE-2024-10585`	5.3 Medium	villu164	Yes
2024-02-08 00:00	InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure InfiniteWP Client <= 1.12.3	`CVE-2023-6565`	5.9 Medium	Christian Angel	Yes
2023-08-14 00:00	InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure InfiniteWP Client <= 1.11.1	`CVE-2023-2916`	7.5 High	István Márton	Yes
2020-01-14 00:00	InfiniteWP Client <= 1.9.4.4 - Authentication Bypass InfiniteWP Client <= 1.9.4.4	`CVE-2020-8772`	9.8 Critical	WebARX Security	Yes
2017-01-25 00:00	InfiniteWP Client <= 1.6.0 - Unauthenticated PHP Object Injection InfiniteWP Client < 1.6.1.1	`CVE-2016-15004`	9.8 Critical	Yorick Koster,	Yes
2014-12-02 00:00	InfiniteWP Client <= 1.3.7 - Privilege Escalation InfiniteWP Client <= 1.3.7	`N/A`	9.8 Critical	Marc-Alexandre Montpas	Yes
2014-12-02 00:00	InfiniteWP Client <= 1.3.7 - PHP Object Injection InfiniteWP Client <= 1.3.7	`N/A`	9.8 Critical	Marc-Alexandre Montpas	Yes

Showing 1–10 of 10 reports

Latestv1.13.10

InfiniteWP Client

Author

revmakx

4.4(177)

88/100

Last Updated

2026-08-19 (2mo ago)

Active Installs

200,000+

Downloads

8,885,367

Requires WP

3.1+

Requires PHP

Tested up to

WP 7.0.7

Created

2012-04-02 (15y ago)

InfiniteWP allows users to manage unlimited number of WordPress sites from their own server. Main features: Self-hosted system: Resides on your own server and totally under your control One-click updates for WordPress, plugins and themes across all your sites Instant backup and restore your entire site or just the database One-click access to all WP admin panels Bulk Manage plugins & themes: Activate & Deactive multiple plugins & themes on multiple sites simultaneously Bulk Install plugins & themes in multiple sites at once and more.. Visit us at InfiniteWP.com. Check out the InfiniteWP Overview Video below. Credits: Vladimir Prelovac for his worker plugin on which the client plugin is being developed.

View on WordPress.org