CVE-2023-3977

Published: Jul 28, 2023Modified: Apr 8, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected (10)

Products: Backupbliss: Backup Migration, Clone · Copy Delete Posts: Duplicate Post · Inisev: Enhanced Text Widget, Redirection, Rss Redirect & Feedburner Alternative, Ssl Mixed Content Fix, Ultimate Posts Widget · +2 more

Show all products

Backupbliss: Backup Migration, Clone · Copy Delete Posts: Duplicate Post · Inisev: Enhanced Text Widget, Redirection, Rss Redirect & Feedburner Alternative, Ssl Mixed Content Fix, Ultimate Posts Widget · Mypopups: Pop Up · Ultimatelysocial: Social Media Share Buttons & Social Sharing Icons

2 products

1 product

5 products

Rss Redirect & Feedburner Alternative

Ssl Mixed Content Fix

Ultimate Posts Widget

Mypopups

1 product

Pop Up

Ultimatelysocial

1 product

Social Media Share Buttons & Social Sharing Icons

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Backupbliss Backup Migration	Before 1.2.8
Backupbliss Clone	Before 2.3.8
Copy Delete Posts Duplicate Post	Before 1.4.0
Inisev Enhanced Text Widget	Before 1.5.8
Inisev Redirection	Before 1.1.4
Inisev Rss Redirect & Feedburner Alternative	Before 3.8
Inisev Ssl Mixed Content Fix	Before 3.2.4
Inisev Ultimate Posts Widget	Before 2.2.5
Mypopups Pop Up	Before 1.2.0
Ultimatelysocial Social Media Share Buttons & Social Sharing Icons	Before 3.5.8

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (46)

https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.7/banner/misc.php#L351

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php#L427

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/http-https-remover/tags/3.2.3/banner/misc.php#L427

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.1.9/modules/banner/misc.php#L427

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.2.0/modules/banner/misc.php#L432

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/redirect-redirection/tags/1.1.3/includes/banner/misc.php#L427

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.4/banner/misc.php#L343

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.5/banner/misc.php#L351

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.0/banner/misc.php#L424

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.2/banner/misc.php#L434

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/ultimate-social-media-plus/tags/3.5.7/banner/misc.php#L424

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.7/modules/banner/misc.php#L438

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.8/modules/banner/misc.php#L432

Source: security@wordfence.com

Exploit

https://plugins.trac.wordpress.org/changeset/2944041/ultimate-social-media-plus/tags/3.5.8/banner/misc.php?old=2823720&old_path=ultimate-social-media-plus%2Ftags%2F3.5.7%2Fbanner%2Fmisc.php

Source: security@wordfence.com

Patch

https://plugins.trac.wordpress.org/changeset?old_path=%2Fcopy-delete-posts%2Ftags%2F1.3.8&old=2923021&new_path=%2Fcopy-delete-posts%2Ftags%2F1.3.9&new=2923021&sfp_email=&sfph_mail=

Source: security@wordfence.com

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823769%40http-https-remover%2Ftags%2F3.2.3&new=2944114%40http-https-remover%2Ftags%2F3.2.4

Source: security@wordfence.com

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823770%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.7&new=2944116%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.8#file115

Source: security@wordfence.com

Patch

https://www.wordfence.com/threat-intel/vulnerabilities/id/ab7c8926-c762-49b1-bc97-4b7a2f4f97fc?source=cve

Source: security@wordfence.com

Third Party Advisory

https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427