What’s Vulnerable › Vulnerabilities

CVE-2023-0958: Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-28 · updated 2026-06-17
• Weakness: CWE-862

Description

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.

Affected products

• inisev BackupBliss – Backup & Migration with Free Cloud Storage: before 1.2.8 — fixed in 1.2.8
• Migrate Clone: before 2.3.8 — fixed in 2.3.8
• Copy-Delete-Posts Duplicate Post: before 1.4.0 — fixed in 1.4.0
• Enhanced Text Widget: before 1.5.8 — fixed in 1.5.8
• Redirection: before 1.1.4 — fixed in 1.1.4
• inisev Rss Redirect & Feedburner Alternative: before 3.8 — fixed in 3.8
• inisev Ssl Mixed Content Fix: before 3.2.4 — fixed in 3.2.4
• Ultimate Posts Widget: before 2.2.5 — fixed in 2.2.5
• Pop-ups Pop-up (WordPress plugin): before 1.2.0 — fixed in 1.2.0
• Socialshare Social Share Icons & Social Share Buttons: before 3.5.8 — fixed in 3.5.8
• inisev Social Media Share Buttons & Social Sharing Icons: before 2.8.2 — fixed in 2.8.2

How to fix

Upgrade to a fixed version: inisev BackupBliss – Backup & Migration with Free Cloud Storage 1.2.8; Migrate Clone 2.3.8; Copy-Delete-Posts Duplicate Post 1.4.0; Enhanced Text Widget 1.5.8; Redirection 1.1.4; inisev Rss Redirect & Feedburner Alternative 3.8; inisev Ssl Mixed Content Fix 3.2.4; Ultimate Posts Widget 2.2.5; Pop-ups Pop-up (WordPress plugin) 1.2.0; Socialshare Social Share Icons & Social Share Buttons 3.5.8; inisev Social Media Share Buttons & Social Sharing Icons 2.8.2. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434
• https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426
• https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434
• https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339
• https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.7/banner/misc.php#L351
• https://plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php#L427
• https://plugins.trac.wordpress.org/browser/http-https-remover/tags/3.2.3/banner/misc.php#L427
• https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.1.9/modules/banner/misc.php#L427
• https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.2.0/modules/banner/misc.php#L432
• https://plugins.trac.wordpress.org/browser/redirect-redirection/tags/1.1.3/includes/banner/misc.php#L427
• https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.4/banner/misc.php#L343

Get alerted when CVE-2023-0958 or the next vulnerability affects your stack