InfiniteWP Client (<= 1.13.10) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/infinitewp-client--1.13.10/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 19:22:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgInfiniteWP Client: Weak 31-bit cryptographic signing key in NOSSL modehttps://feed.craftedsignal.io/briefs/2026-11-infinitewp-weak-crypto/Fri, 06 Nov 2026 19:22:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-infinitewp-weak-crypto/InfiniteWP Client version 1.13.10 uses a 31-bit entropy signing key for its NOSSL authentication branch, allowing for practical brute-force recovery and permanent bypass of secure RSA authentication.InfiniteWP Client version 1.13.10, a WordPress management plugin, contains a critical cryptographic vulnerability in its "NOSSL" authentication branch. This branch is triggered by an enrolling management panel setting a specific request parameter, even on hosts capable of robust RSA verification. Once the NOSSL mode is active, it becomes the permanent authentication method, rendering the secure RSA branch unreachable. The signing key is generated with only 31 bits of entropy, which has been demonstrated to be recoverable via brute-force in under five minutes.

Impact

Successful recovery of the weak 31-bit signing key allows an attacker to bypass authentication, effectively granting full management control over the affected WordPress installation.

Recommendation

  • Inventory all WordPress instances running the InfiniteWP Client plugin.
  • Audit the 'NOSSL' configuration setting within the plugin settings to identify and revert instances currently utilizing this insecure authentication branch.
  • Monitor for unauthorized authentication attempts or unexpected changes in management panel enrollment settings on WordPress sites.
  • Evaluate the necessity of the NOSSL branch and prioritize migration to the secure RSA-based authentication flow.
]]>mediumadvisory