CVE-2023-0958: Backupbliss Backup Migration

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.

Affected products

• Backupbliss Backup Migration: before 1.2.8 (fixed in 1.2.8)
• Backupbliss Clone: before 2.3.8 (fixed in 2.3.8)
• Copy-Delete-Posts Duplicate Post: before 1.4.0 (fixed in 1.4.0)
• Inisev Enhanced Text Widget: before 1.5.8 (fixed in 1.5.8)
• Inisev Redirection: before 1.1.4 (fixed in 1.1.4)
• Inisev Rss Redirect & Feedburner Alternative: before 3.8 (fixed in 3.8)
• Inisev SSL Mixed Content Fix: before 3.2.4 (fixed in 3.2.4)
• Inisev Ultimate Posts Widget: before 2.2.5 (fixed in 2.2.5)
• Mypopups Pop-Up: before 1.2.0 (fixed in 1.2.0)
• Socialshare Social Share Icons & Social Share Buttons: before 3.5.8 (fixed in 3.5.8)
• Ultimatelysocial Social Media Share Buttons & Social Sharing Icons: before 2.8.2 (fixed in 2.8.2)

Published 2023-07-28. Last modified 2026-06-17.