CVE-2023-0958
Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function
CVE-2023-0958 is a medium vulnerability (CVSS 4.3) in Backupbliss Backup Migration, published July 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 52nd percentile. No source names a fixed version.
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
- Record
CVE-2023-0958- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2023-12943
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
- Record
EUVD-2023-12943- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hpq9-m2jp-4fgr
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins...
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
- Record
GHSA-hpq9-m2jp-4fgr- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
- Record
CVE-2023-0958- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
- backupbliss backup migration
- backupbliss clone
- cl272 enhanced text widget
- cl272 ultimate posts widget
- copy-delete-posts duplicate post
- copydeleteposts duplicate post
- inisev backupbliss – backup & migration with free cloud storage
- inisev duplicate post
- inisev enhanced text widget
- inisev pop-up
- inisev redirection
- inisev rss redirect \& feedburner alternative
Show 16 moreShow less
- inisev social media share buttons & social sharing icons
- inisev social share icons & social share buttons
- inisev ssl mixed content fix
- inisev ultimate posts widget
- migrate clone
- mypopups pop-up
- popups pop-up
- s-feeds rss redirect & feedburner alternative
- social share pro share icons & social share buttons
- socialshare social share icons \& social share buttons
- steve85b ssl mixed content fix
- ultimatelysocial social media share buttons \& social sharing icons
- unknown enhanced text widget
- unknown redirection
- unknown social media share buttons & social sharing icons
- unknown ultimate posts widget
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD |
References
wordfence.com/threat-intel/vulnerabilities/id/cf7bdd0e-f3b3-4be5-8a30-2c6d9cb783a3?source=cve
plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-0958
github.com/advisories/GHSA-hpq9-m2jp-4fgr