CVE-2023-0958: Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation…

PriorityP336medium6.5CVSS 3.1

AVNACLPRLUINSUCNIHAN

EPSS

0.56%

42.2th percentile

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.

Affected

22 ranges

Vendor	Product	Version range	Fixed in
backupbliss	backup_migration	< 1.2.8	1.2.8
backupbliss	clone	< 2.3.8	2.3.8
cl272	enhanced_text_widget	<= 1.5.7	—
cl272	ultimate_posts_widget	<= 2.2.4	—
copy-delete-posts	duplicate_post	< 1.4.0	1.4.0
inisev	backupbliss_backup_migration_with_free_cloud_storage	<= 1.2.7	—
inisev	duplicate_post	<= 1.3.9	—
inisev	enhanced_text_widget	< 1.5.8	1.5.8
inisev	pop-up	<= 1.1.9	—
inisev	redirection	< 1.1.4	1.1.4
inisev	redirection	<= 1.1.3	—
inisev	rss_redirect_feedburner_alternative	< 3.8	3.8
inisev	social_media_share_buttons_social_sharing_icons	<= 2.8.1	—
inisev	social_share_icons_social_share_buttons	<= 3.5.7	—
inisev	ssl_mixed_content_fix	< 3.2.4	3.2.4
inisev	ultimate_posts_widget	< 2.2.5	2.2.5
migrate	clone	<= 2.3.7	—
mypopups	pop-up	< 1.2.0	1.2.0
s-feeds	rss_redirect_feedburner_alternative	<= 3.7	—
socialshare	social_share_icons_social_share_buttons	< 3.5.8	3.5.8
steve85b	ssl_mixed_content_fix	<= 3.2.3	—
ultimatelysocial	social_media_share_buttons_social_sharing_icons	< 2.8.2	2.8.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.