CVE-2023-0958

Published: Jul 28, 2023Modified: Apr 8, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.

Affected (11)

Products: Backupbliss: Backup Migration, Clone · Copy Delete Posts: Duplicate Post · Inisev: Enhanced Text Widget, Redirection, Rss Redirect & Feedburner Alternative, Ssl Mixed Content Fix, Ultimate Posts Widget · +3 more

Show all products

Backupbliss: Backup Migration, Clone · Copy Delete Posts: Duplicate Post · Inisev: Enhanced Text Widget, Redirection, Rss Redirect & Feedburner Alternative, Ssl Mixed Content Fix, Ultimate Posts Widget · Mypopups: Pop Up · Socialshare: Social Share Icons & Social Share Buttons · Ultimatelysocial: Social Media Share Buttons & Social Sharing Icons

2 products

1 product

5 products

Rss Redirect & Feedburner Alternative

Ssl Mixed Content Fix

Ultimate Posts Widget

Mypopups

1 product

Pop Up

Socialshare

1 product

Social Share Icons & Social Share Buttons

Ultimatelysocial

1 product

Social Media Share Buttons & Social Sharing Icons

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Backupbliss Backup Migration	Before 1.2.8
Backupbliss Clone	Before 2.3.8
Copy Delete Posts Duplicate Post	Before 1.4.0
Inisev Enhanced Text Widget	Before 1.5.8
Inisev Redirection	Before 1.1.4
Inisev Rss Redirect & Feedburner Alternative	Before 3.8
Inisev Ssl Mixed Content Fix	Before 3.2.4
Inisev Ultimate Posts Widget	Before 2.2.5
Mypopups Pop Up	Before 1.2.0
Socialshare Social Share Icons & Social Share Buttons	Before 3.5.8
Ultimatelysocial Social Media Share Buttons & Social Sharing Icons	Before 2.8.2

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (46)

https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.7/banner/misc.php#L351

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php#L427

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/http-https-remover/tags/3.2.3/banner/misc.php#L427

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.1.9/modules/banner/misc.php#L427

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.2.0/modules/banner/misc.php#L432

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/redirect-redirection/tags/1.1.3/includes/banner/misc.php#L427

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.4/banner/misc.php#L343

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.5/banner/misc.php#L351

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.0/banner/misc.php#L424

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.2/banner/misc.php#L434

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/ultimate-social-media-plus/tags/3.5.7/banner/misc.php#L424

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.7/modules/banner/misc.php#L438

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.8/modules/banner/misc.php#L432

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/changeset/2944041/ultimate-social-media-plus/tags/3.5.8/banner/misc.php?old=2823720&old_path=ultimate-social-media-plus%2Ftags%2F3.5.7%2Fbanner%2Fmisc.php

Source: security@wordfence.com

Patch

https://plugins.trac.wordpress.org/changeset?old_path=%2Fcopy-delete-posts%2Ftags%2F1.3.8&old=2923021&new_path=%2Fcopy-delete-posts%2Ftags%2F1.3.9&new=2923021&sfp_email=&sfph_mail=

Source: security@wordfence.com

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823769%40http-https-remover%2Ftags%2F3.2.3&new=2944114%40http-https-remover%2Ftags%2F3.2.4

Source: security@wordfence.com

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823770%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.7&new=2944116%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.8#file115

Source: security@wordfence.com

Patch

https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7bdd0e-f3b3-4be5-8a30-2c6d9cb783a3?source=cve

Source: security@wordfence.com

Third Party Advisory

https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427