Vulnerability · high
InfiniteWP Client signing key has only 31 bits of secret and is recovered in minutes
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: WordPress sites running InfiniteWP Client 1.13.10 (about 200,000 installs)
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
The Brief
- InfiniteWP Client 1.13.10, a WordPress management plugin on roughly 200,000 installs, has a NOSSL authentication branch whose signing key has only 31 bits of secret.
- The key was recovered live in 291.9 seconds, according to the oss-security post.
- The strong branch verifies an RSA signature; the weak key affects the NOSSL branch, which is selected by the enrolling side.
Why it matters
A signing key this small can be brute-forced quickly, so an attacker could potentially forge authenticated messages between the plugin and its management panel on affected WordPress sites.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: WordPress management plugin run by agencies and developers to manage client sites. |
| No | Core infrastructure | Judgment: a single WordPress plugin, not software nearly every team runs. |
| Yes | Popular tool | Judgment: WordPress management plugin on roughly 200,000 installs, widely deployed in that ecosystem. |
| No | Exploited in the wild | Open Source Security: key recovered live in 291.9 seconds; no observed attacks reported. |
| No | Public exploit | Open Source Security: source describes a live recovery but does not say exploit code was published. |
| No | Remote, no login | Open Source Security: source does not state that unauthenticated network access is sufficient. |
| No | Full takeover | Open Source Security: source does not report code execution, admin rights or account takeover. |
| No | Secrets exposed | Open Source Security: signing key recovered in a demonstration; no stolen or exposed data reported. |
| No | Supply chain | Open Source Security: a weak signing key flaw; no compromised package or update reported. |
| No | No fix yet | Open Source Security: source does not state whether a patched version exists. |
Timeline
Weak NOSSL signing key disclosed on oss-security, recovered live in 291.9 seconds
Open Source Security
InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds
Source
InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds ↗ Open Source Security · 21h ago
First seen · 1 source · Full story page · How tiers are decided