What’s Vulnerable › Vulnerabilities

CVE-2023-3977: Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-28 · updated 2026-06-17
• Weakness: CWE-352

Description

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products

• inisev BackupBliss – Backup & Migration with Free Cloud Storage: before 1.2.8 — fixed in 1.2.8
• Migrate Clone: before 2.3.8 — fixed in 2.3.8
• Copy-Delete-Posts Duplicate Post: before 1.4.0 — fixed in 1.4.0
• Enhanced Text Widget: before 1.5.8 — fixed in 1.5.8
• Redirection: before 1.1.4 — fixed in 1.1.4
• inisev Rss Redirect & Feedburner Alternative: before 3.8 — fixed in 3.8
• inisev Ssl Mixed Content Fix: before 3.2.4 — fixed in 3.2.4
• Ultimate Posts Widget: before 2.2.5 — fixed in 2.2.5
• Pop-ups Pop-up (WordPress plugin): before 1.2.0 — fixed in 1.2.0
• inisev Social Media Share Buttons & Social Sharing Icons: before 3.5.8 — fixed in 3.5.8

How to fix

Upgrade to a fixed version: inisev BackupBliss – Backup & Migration with Free Cloud Storage 1.2.8; Migrate Clone 2.3.8; Copy-Delete-Posts Duplicate Post 1.4.0; Enhanced Text Widget 1.5.8; Redirection 1.1.4; inisev Rss Redirect & Feedburner Alternative 3.8; inisev Ssl Mixed Content Fix 3.2.4; Ultimate Posts Widget 2.2.5; Pop-ups Pop-up (WordPress plugin) 1.2.0; inisev Social Media Share Buttons & Social Sharing Icons 3.5.8. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434
• https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426
• https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434
• https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339
• https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.7/banner/misc.php#L351
• https://plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php#L427
• https://plugins.trac.wordpress.org/browser/http-https-remover/tags/3.2.3/banner/misc.php#L427
• https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.1.9/modules/banner/misc.php#L427
• https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.2.0/modules/banner/misc.php#L432
• https://plugins.trac.wordpress.org/browser/redirect-redirection/tags/1.1.3/includes/banner/misc.php#L427
• https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.4/banner/misc.php#L343

Get alerted when CVE-2023-3977 or the next vulnerability affects your stack