{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/infinitewp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InfiniteWP Client (\u003c= 1.13.10)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["InfiniteWP"],"content_html":"\u003cp\u003eInfiniteWP Client version 1.13.10, a WordPress management plugin, contains a critical cryptographic vulnerability in its \u0026quot;NOSSL\u0026quot; authentication branch. This branch is triggered by an enrolling management panel setting a specific request parameter, even on hosts capable of robust RSA verification. Once the NOSSL mode is active, it becomes the permanent authentication method, rendering the secure RSA branch unreachable. The signing key is generated with only 31 bits of entropy, which has been demonstrated to be recoverable via brute-force in under five minutes.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful recovery of the weak 31-bit signing key allows an attacker to bypass authentication, effectively granting full management control over the affected WordPress installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all WordPress instances running the InfiniteWP Client plugin.\u003c/li\u003e\n\u003cli\u003eAudit the 'NOSSL' configuration setting within the plugin settings to identify and revert instances currently utilizing this insecure authentication branch.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized authentication attempts or unexpected changes in management panel enrollment settings on WordPress sites.\u003c/li\u003e\n\u003cli\u003eEvaluate the necessity of the NOSSL branch and prioritize migration to the secure RSA-based authentication flow.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T19:22:48Z","date_published":"2026-11-06T19:22:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-infinitewp-weak-crypto/","summary":"InfiniteWP Client version 1.13.10 uses a 31-bit entropy signing key for its NOSSL authentication branch, allowing for practical brute-force recovery and permanent bypass of secure RSA authentication.","title":"InfiniteWP Client: Weak 31-bit cryptographic signing key in NOSSL mode","url":"https://feed.craftedsignal.io/briefs/2026-11-infinitewp-weak-crypto/"}],"language":"en","title":"CraftedSignal Threat Feed - InfiniteWP","version":"https://jsonfeed.org/version/1.1"}