CVE-2023-0958
Medium
Description
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Copy-delete-posts Duplicate Post
PublishedJul 28, 2023
First seenJul 28, 2023
Weakness typeCWE-862Missing authorization
How to fix
Update
- copy-delete-posts duplicate_post1.4.0 or later
- backupbliss backup_migration1.2.8 or later
- backupbliss clone2.3.8 or later
- inisev enhanced_text_widget1.5.8 or later
- inisev redirection1.1.4 or later
- inisev rss_redirect_\&_feedburner_alternative3.8 or later
- inisev ssl_mixed_content_fix3.2.4 or later
- inisev ultimate_posts_widget2.2.5 or later
- mypopups pop-up1.2.0 or later
- socialshare social_share_icons_\&_social_share_buttons3.5.8 or later
- ultimatelysocial social_media_share_buttons_\&_social_sharing_icons2.8.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| copy-delete-posts duplicate_post | v < 1.4.0 | 1.4.0 |
| backupbliss backup_migration | v < 1.2.8 | 1.2.8 |
| backupbliss clone | v < 2.3.8 | 2.3.8 |
| inisev enhanced_text_widget | v < 1.5.8 | 1.5.8 |
| inisev redirection | v < 1.1.4 | 1.1.4 |
| inisev rss_redirect_\&_feedburner_alternative | v < 3.8 | 3.8 |
| inisev ssl_mixed_content_fix | v < 3.2.4 | 3.2.4 |
| inisev ultimate_posts_widget | v < 2.2.5 | 2.2.5 |
| mypopups pop-up | v < 1.2.0 | 1.2.0 |
| socialshare social_share_icons_\&_social_share_buttons | v < 3.5.8 | 3.5.8 |
| ultimatelysocial social_media_share_buttons_\&_social_sharing_icons | v < 2.8.2 | 2.8.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.