CVE-2020-8772: InfiniteWP Client WordPress plugin missing authorization allows admin login

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no privileges or interaction required, very high EPSS, and public exploit references make this an urgent authentication bypass.

What it is

The InfiniteWP Client plugin for WordPress before 1.9.4.5 lacks an authorization check in iwp_mmb_set_request in init.php. An attacker who knows an administrator's username can authenticate as that administrator. This is a critical authentication bypass affecting any site running an unpatched version of the plugin.

Impact

An attacker gains full administrative access to the WordPress site, enabling complete control over content, users, plugins and configuration. Because the flaw is an authentication bypass, no password or prior access is required.

Attack surface

Reachable over the network through the plugin's request handling in init.php; the CVSS vector shows no privileges required and no user interaction. The only precondition stated is knowledge of an administrator username.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.88049, 99.76th percentile) and public references are tagged Exploit, indicating known public exploitation techniques. No ransomware association is documented.

What to do

• Update the InfiniteWP Client plugin to version 1.9.4.5 or later immediately.
• If patching is not possible, deactivate or remove the plugin until it can be updated.
• Audit administrator accounts and rotate credentials for any account whose username may be known.
• Restrict access to WordPress admin and plugin endpoints by IP or WAF rules where feasible.
• Monitor for unexpected administrator logins and review user role changes.

Detection

• Review web server and WordPress logs for authentication events against admin accounts from unexpected source IPs.
• Hunt for requests to plugin endpoints handling iwp_mmb_set_request or init.php parameters.
• Alert on new administrator account creation or privilege escalation shortly after suspicious logins.
• Correlate login timestamps with plugin file access to identify exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.