Posted by theknell--- via Fulldisclosure on Nov 12 InfiniteWP Client 1.13.10 — a WordPress management plugin on roughly 200,000 installs — speaks to its management panel through two authentication branches. The strong branch verifies an RSA signature. The other, NOSSL, is selected by the enrolling panel setting one request parameter, on hosts fully capable of RSA. Once its key is stored, the selection is permanent and the RSA branch is unreachable. The stored key is generated as:...