CVE-2023-3977 is a Cross-Site Request Forgery (CSRF) vulnerability affecting several WordPress plugins by Inisev, including backupbliss, copy-delete-posts, inisev, mypopups, and ultimatelysocial. This flaw allows unauthenticated attackers to install plugins from a limited list on a vulnerable site. The vulnerability stems from a missing nonce check in the handle_installation function, which is triggered via an AJAX action. The vulnerability has a CVSS score of 4.3 (Medium), indicating a low potential impact (unauthorized installation of plugins) with a network attack vector and low attack complexity, but requiring user interaction (UI:R). While the impact is limited to unauthorized plugin installations, it could potentially lead to further compromise if a malicious plugin were installed. Currently, there is no evidence of active exploitation, nor is there any public exploit code available (Metasploit, Nuclei, ExploitDB). Community discussion and media coverage for this CVE are also minimal, suggesting low awareness and attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.2.8CPE matchmatch criteria | cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:* | ||
< 2.3.8CPE matchmatch criteria | cpe:2.3:a:backupbliss:clone:*:*:*:*:*:wordpress:*:* | ||
< 1.4.0CPE matchmatch criteria | cpe:2.3:a:copy-delete-posts:duplicate_post:*:*:*:*:*:wordpress:*:* | ||
< 1.5.8CPE matchmatch criteria | cpe:2.3:a:inisev:enhanced_text_widget:*:*:*:*:*:wordpress:*:* | ||
< 1.1.4CPE matchmatch criteria | cpe:2.3:a:inisev:redirection:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.