Lucene search

[email protected]NVD:CVE-2023-0958

HistoryJul 28, 2023 - 5:15 a.m.

CVE-2023-0958

2023-07-2805:15:09

[email protected]

web.nvd.nist.gov

wordpress

inisev

unauthorized installation

capability check

ajax action

authenticated attackers

subscribers

duplicate vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

49.2%

JSON

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.

Affected configurations

Nvd

Node

backupblissbackup_migrationRange<1.2.8wordpress

backupblisscloneRange<2.3.8wordpress

copy-delete-postsduplicate_postRange<1.4.0wordpress

inisevredirectionRange<1.1.4wordpress

inisevrss_redirect_\&_feedburner_alternativeRange<3.8wordpress

inisevssl_mixed_content_fixRange<3.2.4wordpress

mypopupspop-upRange<1.2.0wordpress

socialsharesocial_share_icons_\&_social_share_buttonsRange<3.5.8wordpress

themecheckenhanced_text_widgetRange<1.5.8wordpress

themecheckultimate_posts_widgetRange<2.2.5wordpress

ultimatelysocialsocial_media_share_buttons_\&_social_sharing_iconsRange<2.8.2wordpress

VendorProductVersionCPE
backupblissbackup_migration*cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:*
backupblissclone*cpe:2.3:a:backupbliss:clone:*:*:*:*:*:wordpress:*:*
copy-delete-postsduplicate_post*cpe:2.3:a:copy-delete-posts:duplicate_post:*:*:*:*:*:wordpress:*:*
inisevredirection*cpe:2.3:a:inisev:redirection:*:*:*:*:*:wordpress:*:*
inisevrss_redirect_\&_feedburner_alternative*cpe:2.3:a:inisev:rss_redirect_\&_feedburner_alternative:*:*:*:*:*:wordpress:*:*
inisevssl_mixed_content_fix*cpe:2.3:a:inisev:ssl_mixed_content_fix:*:*:*:*:*:wordpress:*:*
mypopupspop-up*cpe:2.3:a:mypopups:pop-up:*:*:*:*:*:wordpress:*:*
socialsharesocial_share_icons_\&_social_share_buttons*cpe:2.3:a:socialshare:social_share_icons_\&_social_share_buttons:*:*:*:*:*:wordpress:*:*
themecheckenhanced_text_widget*cpe:2.3:a:themecheck:enhanced_text_widget:*:*:*:*:*:wordpress:*:*
themecheckultimate_posts_widget*cpe:2.3:a:themecheck:ultimate_posts_widget:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
backupbliss	backup_migration	*	cpe:2.3:a:backupbliss:backup_migration::::::wordpress::*
backupbliss	clone	*	cpe:2.3:a:backupbliss:clone::::::wordpress::*
copy-delete-posts	duplicate_post	*	cpe:2.3:a:copy-delete-posts:duplicate_post::::::wordpress::*
inisev	redirection	*	cpe:2.3:a:inisev:redirection::::::wordpress::*
inisev	rss_redirect_\&_feedburner_alternative	*	cpe:2.3:a:inisev:rss_redirect_\&_feedburner_alternative::::::wordpress::*
inisev	ssl_mixed_content_fix	*	cpe:2.3:a:inisev:ssl_mixed_content_fix::::::wordpress::*
mypopups	pop-up	*	cpe:2.3:a:mypopups:pop-up::::::wordpress::*
socialshare	social_share_icons_\&_social_share_buttons	*	cpe:2.3:a:socialshare:social_share_icons_\&_social_share_buttons::::::wordpress::*
themecheck	enhanced_text_widget	*	cpe:2.3:a:themecheck:enhanced_text_widget::::::wordpress::*
themecheck	ultimate_posts_widget	*	cpe:2.3:a:themecheck:ultimate_posts_widget::::::wordpress::*

Rows per page:

1-10 of 111

References

plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427

plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434

plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426

plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434

plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339

plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.7/banner/misc.php#L351

plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php#L427

plugins.trac.wordpress.org/browser/http-https-remover/tags/3.2.3/banner/misc.php#L427

plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.1.9/modules/banner/misc.php#L427

plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.2.0/modules/banner/misc.php#L432

plugins.trac.wordpress.org/browser/redirect-redirection/tags/1.1.3/includes/banner/misc.php#L427

plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.4/banner/misc.php#L343

plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.5/banner/misc.php#L351

plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.0/banner/misc.php#L424

plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.2/banner/misc.php#L434

plugins.trac.wordpress.org/browser/ultimate-social-media-plus/tags/3.5.7/banner/misc.php#L424

plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.7/modules/banner/misc.php#L438

plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.8/modules/banner/misc.php#L432

plugins.trac.wordpress.org/changeset/2944041/ultimate-social-media-plus/tags/3.5.8/banner/misc.php?old=2823720&old_path=ultimate-social-media-plus%2Ftags%2F3.5.7%2Fbanner%2Fmisc.php

plugins.trac.wordpress.org/changeset?old_path=%2Fcopy-delete-posts%2Ftags%2F1.3.8&old=2923021&new_path=%2Fcopy-delete-posts%2Ftags%2F1.3.9&new=2923021&sfp_email=&sfph_mail=

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823769%40http-https-remover%2Ftags%2F3.2.3&new=2944114%40http-https-remover%2Ftags%2F3.2.4

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823770%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.7&new=2944116%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.8#file115

www.wordfence.com/threat-intel/vulnerabilities/id/cf7bdd0e-f3b3-4be5-8a30-2c6d9cb783a3?source=cve