Cross-Site Request Forgery Vulnerability in Inisev WordPress Plugins

CVE-2023-3977

What is CVE-2023-3977?

Multiple Inisev plugins for WordPress are susceptible to Cross-Site Request Forgery attacks due to a missing nonce verification in the handle_installation function. This vulnerability enables unauthorized attackers to force plugin installations by tricking an admin into clicking a malicious link, thus executing forged requests. Affected plugins include Feedburner Alternative and RSS Redirect, Ultimate Social Media Icons, and several others. It is crucial for site administrators to be vigilant about potential social engineering tactics that exploit this flaw.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References