CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NCVE-2023-0958
Medium (6.5). EPSS 0.7% chance of exploitation in the next 30 days.
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- backupbliss:backup_migration
- backupbliss:clone
- copy-delete-posts:duplicate_post
- inisev:enhanced_text_widget
- inisev:redirection
- inisev:rss_redirect_\&_feedburner_alternative
- inisev:ssl_mixed_content_fix
- inisev:ultimate_posts_widget
- mypopups:pop-up
- socialshare:social_share_icons_\&_social_share_buttons
- ultimatelysocial:social_media_share_buttons_\&_social_sharing_icons
References
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434
- https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426
- https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434
- https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339