Security · High impactFan score 21 · Tier C
InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds
The Brief
- InfiniteWP Client 1.13.10, a WordPress management plugin on roughly 200,000 installs, has a NOSSL authentication branch whose signing key has only 31 bits of secret.
- The key was recovered live in 291.9 seconds, according to the oss-security post.
- The strong branch verifies an RSA signature; the weak key affects the NOSSL branch, which is selected by the enrolling side.
Why it matters
A signing key this small can be brute-forced quickly, so an attacker could potentially forge authenticated messages between the plugin and its management panel on affected WordPress sites.
Who’s affected
- Sites running InfiniteWP Client 1.13.10
- Administrators using InfiniteWP management panels
- InfiniteWP Client 1.13.10
- #wordpress
- #security
- #authentication
- #signing-keys
- #plugins
Posted by theknell on Nov 06 InfiniteWP Client 1.13.10 — a WordPress management plugin on roughly 200,000 installs — speaks to its management panel through two authentication branches. The strong branch verifies an RSA signature. The other, NOSSL, is selected by the enrolling…
Timeline
Weak NOSSL signing key disclosed on oss-security, recovered live in 291.9 seconds
Open Source Security
InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds