4.3

CVE-2023-3977

Exploit

Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mögliche Gegenmaßnahme
Backup Migration: Update to version 1.2.8, or a newer patched version
Duplicate Post: Update to version 1.4.0, or a newer patched version
Enhanced Text Widget: Update to version 1.5.8, or a newer patched version
RSS Redirect & Feedburner Alternative: Update to version 3.8, or a newer patched version
SSL Mixed Content Fix: Update to version 3.2.4, or a newer patched version
Pop-up: Update to version 1.2.0, or a newer patched version
Redirection: Update to version 1.1.4, or a newer patched version
Ultimate Posts Widget: Update to version 2.2.5, or a newer patched version
Social Media Share Buttons & Social Sharing Icons: Update to version 2.8.2, or a newer patched version
Social Share Icons & Social Share Buttons: Update to version 3.5.8, or a newer patched version
Clone: Update to version 2.3.8, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Backupbliss ≫ Backup Migration SwPlatformwordpress Version < 1.2.8
Backupbliss ≫ Clone SwPlatformwordpress Version < 2.3.8
Copy-delete-posts ≫ Duplicate Post SwPlatformwordpress Version < 1.4.0
Inisev ≫ Enhanced Text Widget SwPlatformwordpress Version < 1.5.8
Inisev ≫ Redirection SwPlatformwordpress Version < 1.1.4
Inisev ≫ Ssl Mixed Content Fix SwPlatformwordpress Version < 3.2.4
Inisev ≫ Ultimate Posts Widget SwPlatformwordpress Version < 2.2.5
Mypopups ≫ Pop-up SwPlatformwordpress Version < 1.2.0
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Backup Migration
Version *-1.2.7
SystemWordPress Plugin
≫
Produkt Duplicate Post
Version *-1.3.9
SystemWordPress Plugin
≫
Produkt Enhanced Text Widget
Version *-1.5.7
SystemWordPress Plugin
≫
Produkt RSS Redirect & Feedburner Alternative
Version *-3.7
SystemWordPress Plugin
≫
Produkt SSL Mixed Content Fix
Version *-3.2.3
SystemWordPress Plugin
≫
Produkt Pop-up
Version *-1.1.9
SystemWordPress Plugin
≫
Produkt Redirection
Version *-1.1.3
SystemWordPress Plugin
≫
Produkt Ultimate Posts Widget
Version *-2.2.4
SystemWordPress Plugin
≫
Produkt Social Media Share Buttons & Social Sharing Icons
Version *-2.8.1
SystemWordPress Plugin
≫
Produkt Social Share Icons & Social Share Buttons
Version *-3.5.7
SystemWordPress Plugin
≫
Produkt Clone
Version *-2.3.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.51% 0.395
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
security@wordfence.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427
Exploit
https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434
Exploit
https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426
Exploit
https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434
Exploit
https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339
Exploit
https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.7/banner/misc.php#L351
Exploit
https://plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php#L427
Exploit
https://plugins.trac.wordpress.org/browser/http-https-remover/tags/3.2.3/banner/misc.php#L427
Exploit
https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.1.9/modules/banner/misc.php#L427
Exploit
https://plugins.trac.wordpress.org/browser/pop-up-pop-up/tags/1.2.0/modules/banner/misc.php#L432
Exploit
https://plugins.trac.wordpress.org/browser/redirect-redirection/tags/1.1.3/includes/banner/misc.php#L427
Exploit
https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.4/banner/misc.php#L343
Exploit
https://plugins.trac.wordpress.org/browser/ultimate-posts-widget/tags/2.2.5/banner/misc.php#L351
Exploit
https://plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.0/banner/misc.php#L424
Exploit
https://plugins.trac.wordpress.org/browser/ultimate-social-media-icons/tags/2.8.2/banner/misc.php#L434
Exploit
https://plugins.trac.wordpress.org/browser/ultimate-social-media-plus/tags/3.5.7/banner/misc.php#L424
Exploit
https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.7/modules/banner/misc.php#L438
Exploit
https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.3.8/modules/banner/misc.php#L432
Exploit
https://plugins.trac.wordpress.org/changeset/2944041/ultimate-social-media-plus/tags/3.5.8/banner/misc.php?old=2823720&old_path=ultimate-social-media-plus%2Ftags%2F3.5.7%2Fbanner%2Fmisc.php
Patch
https://plugins.trac.wordpress.org/changeset?old_path=%2Fcopy-delete-posts%2Ftags%2F1.3.8&old=2923021&new_path=%2Fcopy-delete-posts%2Ftags%2F1.3.9&new=2923021&sfp_email=&sfph_mail=
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823769%40http-https-remover%2Ftags%2F3.2.3&new=2944114%40http-https-remover%2Ftags%2F3.2.4
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2823770%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.7&new=2944116%40feedburner-alternative-and-rss-redirect%2Ftags%2F3.8#file115
Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ab7c8926-c762-49b1-bc97-4b7a2f4f97fc?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/ab7c8926-c762-49b1-bc97-4b7a2f4f97fc
Third Party Advisory