Cross-Site Request Forgery Vulnerability in Inisev WordPress Plugins
CVE-2023-3977
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 28 July 2023
What is CVE-2023-3977?
Multiple Inisev plugins for WordPress are susceptible to Cross-Site Request Forgery attacks due to a missing nonce verification in the handle_installation function. This vulnerability enables unauthorized attackers to force plugin installations by tricking an admin into clicking a malicious link, thus executing forged requests. Affected plugins include Feedburner Alternative and RSS Redirect, Ultimate Social Media Icons, and several others. It is crucial for site administrators to be vigilant about potential social engineering tactics that exploit this flaw.
Affected Version(s)
Backup Migration * <= 1.2.7
Clone * <= 2.3.7
Duplicate Post * <= 1.3.9