Cyber ·
InfiniteWP Client 1.13.10: NOSSL key with 31 bits of secret recovered in 291.9 seconds
An analysis posted to the oss-sec list on November 6, 2026 reports that the WordPress plugin InfiniteWP Client 1.13.10 has a NOSSL signing key with only 31 bits of secret, recovered in 291.9 seconds. The text is a machine translation of a public feed.
The report describes InfiniteWP Client 1.13.10, a WordPress management plugin with about 200,000 installations, which communicates with its management dashboard through two authentication paths. The strong path verifies an RSA signature. The other path, NOSSL, is selected when the signup dashboard sets a request parameter, even on hosts fully capable of using RSA.
According to the text, once the key is stored the path selection becomes permanent and the RSA path becomes unreachable. The analysis states that the NOSSL signing key has only 31 bits of secret and was recovered in 291.9 seconds. The available excerpt is truncated before it details how the stored key is generated, so this summary contains no further technical detail.
Relevance for site operators: the information matters to WordPress administrators and management dashboard operators who use this plugin. Rota Nacional does not assess, fix or replace third-party plugins, and this item does not describe any platform feature that solves the engineering problem reported.
How to consult and verify: find the original text in the public oss-sec list archive for November 2026, searching by the report title and version 1.13.10. Confirm the installed version in your environment and follow the developer's official guidance before acting.
If you use AI to study this report, do not paste keys, tokens, passwords, dashboard addresses or site identifiers. Replace those values with placeholders before sending the text.