Cross-Site Request Forgery Vulnerability in Inisev WordPress Plugins
CVE-2023-3977
4.3MEDIUM
Key Information:
- Vendor
- Steve85b
- Status
- Ssl Mixed Content Fix
- Duplicate Post
- Social Share Icons & Social Share Buttons
- Ultimate Posts Widget
- Vendor
- CVE Published:
- 28 July 2023
Summary
Multiple Inisev plugins for WordPress are susceptible to Cross-Site Request Forgery attacks due to a missing nonce verification in the handle_installation function. This vulnerability enables unauthorized attackers to force plugin installations by tricking an admin into clicking a malicious link, thus executing forged requests. Affected plugins include Feedburner Alternative and RSS Redirect, Ultimate Social Media Icons, and several others. It is crucial for site administrators to be vigilant about potential social engineering tactics that exploit this flaw.
Affected Version(s)
Backup Migration * <= 1.2.7
Clone * <= 2.3.7
Duplicate Post * <= 1.3.9
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Chloe Chamberland