Information disclosure via unauthenticated limited directory traversal in debug-chart/index.php, allowing reading of arbitrary .txt files in the backups directory.
This vulnerability affects the following application versions:
- InfiniteWP Client 1.9.4.1
- InfiniteWP Client 1.9.4.4
- InfiniteWP Client 1.9.4.5
- InfiniteWP Client 1.9.4.6
- InfiniteWP Client 1.9.4.8.2
- InfiniteWP Client 1.9.4.11
- InfiniteWP Client 1.9.6
- InfiniteWP Client 1.9.8
- InfiniteWP Client 1.9.9
- InfiniteWP Client 1.11.0
- InfiniteWP Client 1.11.1
- InfiniteWP Client 1.12.1
- InfiniteWP Client 1.12.3
- InfiniteWP Client 1.12.3.1
- InfiniteWP Client 1.12.5
- InfiniteWP Client 1.13.0