InfiniteWP Client NOSSL signing key can be recovered from a captured request
A researcher recovered the management signing key for a NOSSL-enrolled InfiniteWP Client 1.13.10 test site from one captured request and the panel public key. A forged request changed database options. Restrict or disable the management channel while confirming remediation.
- Disclosed
- Nov 6, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- InfiniteWP Client 1.13.10 sites enrolled in NOSSL mode. Key recovery needs a captured signed request and the panel public key.
- wordpress
- In the wild
- Not seen
- The researcher demonstrated key recovery and forgery on a controlled test instance.
What happened
NOSSL derives its management key from a public prefix and at most 31 bits of secret randomness. The researcher used the panel public key and a captured get_stats request to test candidates offline. A forged maintain_site request then wrote new database options on the test site. The signed fields cover the action and message ID while leaving parameters out.
The result applies to NOSSL enrollment. The approximately 200,000 installations cited in the report describe the whole plugin, and the number enrolled in NOSSL is unknown. The report establishes a controlled demonstration.
Crime-scene timeline
Nov 6, 2026
Researcher publishes the NOSSL key-recovery demonstration
The researcher recovered the test key offline in 291.9 seconds and used it to forge a state-changing command.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Researcher disclosure on oss-securityPrimaryDescribes the tested version, NOSSL enrollment, key-recovery prerequisites, timing and controlled command forgery.
- Researcher publicationPrimaryDocuments the experiment and links the signed paper.
- InfiniteWP Client WordPress listingPrimaryVendor listing and changelog for the client plugin. No fix for this report was established from the reviewed listing.