InfiniteWP Client NOSSL key yields only 31 bits of secret
A WordPress management plugin on roughly 200,000 installs can be forced onto a weak permanent authentication path that an offline brute-force recovers in minutes, enabling indefinite command forgery.
By tarpit