CVE-2023-3977

Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.14.3Medium EPSS percentile49th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 18 sources FixVendor fixNo build named by the sources

Published 2023-07-28Updated 2025-04-03Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

inisev RedirectionAffected: ≤ 1.1.3Upgrade to: after 1.1.3Stated by: CVE record
inisev Pop-upAffected: ≤ 1.1.9Upgrade to: after 1.1.9Stated by: CVE record
inisev BackupBliss – Backup & Migration with Free Cloud StorageAffected: ≤ 1.2.7Upgrade to: after 1.2.7Stated by: CVE record
inisev Duplicate PostAffected: ≤ 1.3.9Upgrade to: after 1.3.9Stated by: CVE record
cl272 Enhanced Text WidgetAffected: ≤ 1.5.7Upgrade to: after 1.5.7Stated by: CVE record

Versions as the sources state them. 15 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

In WordPress, open Plugins and check whether you use Redirection, Pop-up, BackupBliss – Backup & Migration with Free Cloud Storage, Duplicate Post, Enhanced Text Widget, Ultimate Posts Widget, Clone, Social Media Share Buttons & Social Sharing Icons, or SSL Mixed Content Fix.
Update BackupBliss – Backup & Migration with Free Cloud Storage to 1.2.8, Clone to 2.3.8, Duplicate Post to 1.4.0, Enhanced Text Widget to 1.5.8, Redirection to 1.1.4, SSL Mixed Content Fix to 3.2.4, Ultimate Posts Widget to 2.2.5, Pop-up to 1.2.0, or Social Media Share Buttons & Social Sharing Icons to 3.5.8.
If you cannot update promptly, temporarily deactivate any affected plugin and review recent plugin installations for anything unexpected.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

In plain language

Written by AI from the record

If your WordPress site uses any of these Inisev plugins below their fixed release, update them because a tricked administrator could unknowingly install an unwanted plugin.

CSRF in the unauthenticated `inisev_installation` AJAX action lacks a nonce check, allowing forced installation of plugins from a limited list when an administrator follows a crafted link or performs a forged action.

If you're affected

Unwanted plugin installation
Website control changes
Customer data exposure
Service disruption

What is it

This flaw can let a criminal set up a misleading action that causes a site administrator’s browser to install an additional plugin without the administrator intending to do so. It is like being tricked into signing a delivery slip that lets an unapproved package into your office.

Who is affected

This matters if you run a WordPress website using Redirection, Pop-up, BackupBliss – Backup & Migration with Free Cloud Storage, Duplicate Post, Enhanced Text Widget, Ultimate Posts Widget, Clone, Social Media Share Buttons & Social Sharing Icons, or SSL Mixed Content Fix. The attacker must first trick a logged-in site administrator into opening or using a crafted link or page.

How urgent is it

Public exploit code is available, so update affected plugins soon. This is an amber issue because the attack needs a site administrator to be tricked into taking an action, and it is not listed in CISA’s catalog of vulnerabilities known to be actively exploited.

What to do — in detail

Confirm exposure by inventorying installed WordPress plugins and their versions, including plugins installed through a hosting control panel or deployment process. Upgrade to BackupBliss – Backup & Migration with Free Cloud Storage 1.2.8+, Clone 2.3.8+, Duplicate Post 1.4.0+, Enhanced Text Widget 1.5.8+, Redirection 1.1.4+, RSS Redirect & Feedburner Alternative 3.8+, SSL Mixed Content Fix 3.2.4+, Ultimate Posts Widget 2.2.5+, Pop-up 1.2.0+, and Social Media Share Buttons & Social Sharing Icons 3.5.8+ where installed.

Test updates on a staging site when possible, especially where a plugin affects redirects, backups, or page content; the findings provide no specific breaking-change warning. If patching is delayed, deactivate affected plugins and avoid administrator sessions on untrusted links or pages until they are updated. No CISA KEV remediation deadline applies because this CVE is not listed in KEV. Review WordPress plugin-installation activity, administrator activity, and the installed-plugin list for unexpected changes.

Technical context

CVE-2023-3977 is CVSS 4.3 (Medium): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The weakness is cross-site request forgery caused by a missing nonce validation in handle_installation, invoked through the inisev_installation AJAX action. An unauthenticated attacker can use a forged request to install plugins from a limited list, contingent on administrator interaction. Public exploit material is available (12 known), while EPSS is 0.6% at the 48th percentile with a flat trend. It is not in CISA KEV; no confirmed in-the-wild exploitation is provided in the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS49th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

18 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 49th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 337 days before any public exploit.

2026-03-06Public exploit / PoCsource: othernuclei check added
2025-04-03Patch availablerecord updated
2023-07-28Published

Affected products

inisevcommercialaka redirection, social media share buttons, backupbliss, social sharing icons
cl272aka enhanced text widget, ultimate posts widget
- Enhanced Text WidgetOn-premWeb & CMS Plugins / wordpress-plugin
- Ultimate Posts WidgetOn-premWeb & CMS Plugins / wordpress-plugin
backupblisscommercialaka backup migration (wordpress plugin)
- backup migrationMixedWeb & CMS Plugins / wordpress-plugin
- cloneMixedWeb & CMS Plugins / wordpress-plugin
migrateaka clone, backup migration
- CloneDevTools & CI
steve85boss-project
- SSL Mixed Content FixOn-premWeb & CMS Plugins / wordpress-plugin
s-feedscommercialaka rss redirect & feedburner alternative
- RSS Redirect & Feedburner AlternativeOn-premWeb & CMS Plugins / wordpress-plugin

And 6 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Scored 4.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action