← Database

CVE-2023-0958

MEDIUM CVSS: 4.3 Published: 2023-07-28 Modified: 2026-06-17

Description

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.

Affected Platforms

Ultimatelysocial Social Media Share Buttons \& Social Sharing IconsInisev RedirectionBackupbliss CloneSocialshare Social Share Icons \& Social Share ButtonsInisev Ultimate Posts WidgetInisev Enhanced Text WidgetInisev Rss Redirect \& Feedburner AlternativeCopy-Delete-Posts Duplicate PostBackupbliss Backup MigrationInisev Ssl Mixed Content Fix

Weakness Type

CWE-862

References