Posted by theknell— via Fulldisclosure on Nov 12
InfiniteWP Client 1.13.10 — a WordPress management plugin on roughly
200,000 installs — speaks to its management panel through two
authentication branches. The strong branch verifies an RSA
signature. The other, NOSSL, is selected by the enrolling panel
setting one request parameter, on hosts fully capable of RSA. Once
its key is stored, the selection is permanent and the RSA branch is
unreachable.
The stored key is generated as:…
Source: Full Disclosure (seclists.org) · 2026-11-13