A catastrophic security flaw was recently uncovered in the InfiniteWP Client plugin, a tool used by agencies and developers to manage thousands of WordPress sites simultaneously. This vulnerability allows attackers to bypass authentication entirely—effectively letting them log in as an administrator without a password.
At WordPress Department, we specialize in WordPress site rescues, and this specific flaw highlights exactly why professional maintenance isn’t just a luxury—it’s a digital necessity.
What is the InfiniteWP Authentication Bypass?
The vulnerability is a logic error within the plugin’s core authentication sequence. InfiniteWP Client is designed to allow a “Master” panel to communicate with “Child” sites. However, a flaw in how the plugin validated these requests meant that an attacker only needed a valid admin username to gain full entry.
The Technical Breakdown: How It Happened
The issue was traced to the iwp_mmb_set_request function in the init.php file.
- The Flaw: Thereadd_siteThe and add_site actions lacked proper authorization checks.
- The Exploit: Attackers could send a specially crafted JSON payload, encoded in Base64, via a raw POST request.
- The Result: If the payload contained a known admin username, the site would automatically initialize a session for that user—no password required.
The Scope of the Risk
With over 300,000+ active installations reported on the WordPress repository (and over 500,000 claimed by the developer), the surface area for this attack is massive.
Warning: A similar bypass was also discovered in WP Time Capsule (20,000+ installs), another plugin by the same developer, Revmakx. If you use both, your risk profile is doubled.
Is Your Website Protected?
While a patch was released (Version 1.9.4.5), thousands of sites remain “dark” or unmaintained, leaving them wide open to automated bot attacks.
Immediate Action Plan for Site Owners:
- Update Immediately: Ensure InfiniteWP Client is at version 1.9.4.5 or higher.
- Audit User Accounts: Check for any new administrator accounts you didn’t create.
- Review Access Logs: Look for suspicious POST requests hitting your init.php or plugin folders.
- Implement 2FA: Two-factor authentication can often act as a secondary fail-safe, even during an auth-bypass event.
Why "Set and Forget" is a Dangerous Strategy
This vulnerability proves that even “convenience” plugins can become a backdoor if not monitored. Managing a global business requires your digital doors to stay open for customers, but locked tight against intruders.
We Rescue and Reinforce WordPress Sites
If you are worried that your site might be vulnerable, or if you’ve noticed strange behavior on your dashboard, don’t wait for a total site collapse.
At WordPress Department, we act as the silent partner for businesses in the UK, US, Australia, and beyond. We don’t just “fix” WordPress; we harden it against the latest threats.
