🚨 CVE-2026-15038 — InfiniteWP Client Admin Takeover

Unauthenticated Admin Account Takeover in WordPress Multisite

📋 Overview

InfiniteWP Client plugin for WordPress (< 1.13.6) contains a critical authentication bypass vulnerability affecting Multisite installations.

An unauthenticated attacker can:

• 🔓 Bypass all authentication checks
• 🔑 Bind their own cryptographic keys
• 👑 Take over admin sessions
• 💻 Achieve Remote Code Execution (RCE)
• 🌐 Compromise the entire WordPress Network

🔍 Root Cause Analysis

🐛 Bug #1: Connection State Mismatch

if (!$iwp_mmb_core->get_option('iwp_client_action_message_id') 
    && !$iwp_mmb_core->get_option('iwp_client_public_key'))

• Reader: Uses get_site_option() → reads from network-level (wp_sitemeta)
• Writer: Uses update_blog_option() → writes to per-blog (wp_X_options)

💥 Result: On Multisite, the guard always returns false — re-pairing is always allowed.

🐛 Bug #2: Activation Key Bypass

if(trim($activation_key) != get_option('iwp_client_activate_key')){

• After activation, the key is deleted → get_option() returns false
• Attacker sends no activation_key → trim(null) → ''
• PHP loose comparison: '' != false → false → Check passes 🎯

🐛 Bug #3: Attacker-Controlled Keypair

• Attacker generates their own RSA keypair
• Signs requests themselves → openssl_verify() passes
• Plugin binds attacker's key to ALL blogs in the network

🚀 Exploitation Chain

graph LR
    A[Send POST Request] --> B[Add Site Action]
    B --> C[Guard Bypassed]
    C --> D[Activation Key Check Fails]
    D --> E[Signature Verifies]
    E --> F[Attacker Key Bound]
    F --> G[Full Admin Access]
    G --> H[RCE Achieved]

💻 Installation

# Clone the repository
git clone https://github.com/yourusername/CVE-2026-15038.git
cd CVE-2026-15038

# Install dependencies
pip install -r requirements.txt

🎯 Usage

Basic Single Target

python3 exploit.py -t https://wordpress.ddev.site

Mass Exploitation

python3 exploit.py -t https://target1.com -t https://target2.com -t https://target3.com

Custom Command Execution

python3 exploit.py -t https://wordpress.ddev.site --command "wp plugin install hello-dolly --activate"

Complete Attack Chain

python3 exploit.py -t https://wordpress.ddev.site --takeover --rce

📂 File Structure

⚠️ Important Notes

• ✅ Works on WordPress Multisite installations
• ❌ Not effective on single-site installations
• 🔒 Patched in InfiniteWP Client 1.13.6
• 🔐 Always update to the latest version

🛡️ Mitigation

1. Immediate Action: Update to InfiniteWP Client ≥ 1.13.6
2. Verify: Check for suspicious admin users
3. Audit: Review recent add_site requests in logs
4. Monitor: Watch for unusual plugin activity

🔗 Resources

• NVD Entry
• WPScan Advisory

⚖️ Disclaimer

This tool is for educational and security testing purposes only. Use only on systems you own or have explicit permission to test. The authors assume no liability for misuse.