CVE-2023-3977
Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Record
CVE-2023-3977- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2023-44602
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Record
EUVD-2023-44602- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6jhg-gg85-9xxf
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to...
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Record
GHSA-6jhg-gg85-9xxf- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Record
CVE-2023-3977- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
- backupbliss backup migration
- backupbliss clone
- cl272 enhanced text widget
- cl272 ultimate posts widget
- copy-delete-posts duplicate post
- copydeleteposts duplicate post
- inisev backupbliss – backup & migration with free cloud storage
- inisev duplicate post
- inisev enhanced text widget
- inisev pop-up
- inisev redirection
- inisev rss redirect \& feedburner alternative
Show 15 moreShow less
- inisev social media share buttons & social sharing icons
- inisev social share icons & social share buttons
- inisev ssl mixed content fix
- inisev ultimate posts widget
- migrate clone
- mypopups pop-up
- popups pop-up
- s-feeds rss redirect & feedburner alternative
- social share pro share icons & social share buttons
- steve85b ssl mixed content fix
- ultimatelysocial social media share buttons \& social sharing icons
- unknown enhanced text widget
- unknown redirection
- unknown social media share buttons & social sharing icons
- unknown ultimate posts widget
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-3977 is a medium vulnerability (CVSS 4.3) in Backupbliss Backup Migration, published July 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. No source names a fixed version.
References
wordfence.com/threat-intel/vulnerabilities/id/ab7c8926-c762-49b1-bc97-4b7a2f4f97fc?source=cve
plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-3977
github.com/advisories/GHSA-6jhg-gg85-9xxf