CVE-2023-3977: Backupbliss Backup Migration

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products

• Backupbliss Backup Migration: before 1.2.8 (fixed in 1.2.8)
• Backupbliss Clone: before 2.3.8 (fixed in 2.3.8)
• Copy-Delete-Posts Duplicate Post: before 1.4.0 (fixed in 1.4.0)
• Inisev Enhanced Text Widget: before 1.5.8 (fixed in 1.5.8)
• Inisev Redirection: before 1.1.4 (fixed in 1.1.4)
• Inisev Rss Redirect & Feedburner Alternative: before 3.8 (fixed in 3.8)
• Inisev SSL Mixed Content Fix: before 3.2.4 (fixed in 3.2.4)
• Inisev Ultimate Posts Widget: before 2.2.5 (fixed in 2.2.5)
• Mypopups Pop-Up: before 1.2.0 (fixed in 1.2.0)
• Ultimatelysocial Social Media Share Buttons & Social Sharing Icons: before 3.5.8 (fixed in 3.5.8)

Published 2023-07-28. Last modified 2026-06-17.