InfiniteWP Client: Weak 31-bit cryptographic signing key in NOSSL mode

InfiniteWP Client version 1.13.10, a WordPress management plugin, contains a critical cryptographic vulnerability in its "NOSSL" authentication branch. This branch is triggered by an enrolling management panel setting a specific request parameter, even on hosts capable of robust RSA verification. Once the NOSSL mode is active, it becomes the permanent authentication method, rendering the secure RSA branch unreachable. The signing key is generated with only 31 bits of entropy, which has been demonstrated to be recoverable via brute-force in under five minutes.

Impact

Successful recovery of the weak 31-bit signing key allows an attacker to bypass authentication, effectively granting full management control over the affected WordPress installation.

Recommendation

• Inventory all WordPress instances running the InfiniteWP Client plugin.
• Audit the 'NOSSL' configuration setting within the plugin settings to identify and revert instances currently utilizing this insecure authentication branch.
• Monitor for unauthorized authentication attempts or unexpected changes in management panel enrollment settings on WordPress sites.
• Evaluate the necessity of the NOSSL branch and prioritize migration to the secure RSA-based authentication flow.