CVE-2023-0958: Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function
Vulnerability summary
CVE-2023-0958 is a medium (CVSS 6.5) Missing Authorization vulnerability in backupbliss backup_migration. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.2% of scored vulnerabilities.
Timeline
- 28-07-2023PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.69% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wordpress11 products
- backup-backup≤ 1.2.7 (fixed in 1.2.8)
- copy-delete-posts≤ 1.3.9 (fixed in 1.4.0)
- enhanced-text-widget≤ 1.5.7 (fixed in 1.5.8)
- feedburner-alternative-and-rss-redirect≤ 3.7 (fixed in 3.8)
- http-https-remover≤ 3.2.3 (fixed in 3.2.4)
Inisev10 products
- backupbliss – backup & migration with free cloud storage≤ 1.2.7
- duplicate post≤ 1.3.9
- enhanced_text_widget< 1.5.8
- pop-up≤ 1.1.9
- redirection≤ 1.1.3 | < 1.1.4
Backupbliss2 products
- backup_migration< 1.2.8
- clone< 2.3.8
Cl2722 products
- enhanced text widget≤ 1.5.7
- ultimate posts widget≤ 2.2.4
Copy-delete-posts1 product
- duplicate_post< 1.4.0
Migrate1 product
- clone≤ 2.3.7
Mypopups1 product
- pop-up< 1.2.0
S-feeds1 product
Socialshare1 product
Steve85b1 product
- ssl mixed content fix≤ 3.2.3
Ultimatelysocial1 product
11 vendors · 32 products