CVE-2023-3977 Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

Medium 4.3 Published 28 Jul 2023 Updated 8 Apr 2026

Unauthenticated attackers can force site administrators to install plugins via CSRF, potentially leading to privilege escalation or code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-3977?

CVE-2023-3977 is a medium-severity vulnerability in cl272 BackupBliss – Backup & Migration with Free Cloud Storage, published on 28 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2023-3977?

It affects 10 products.

Products include Backupbliss Backup Migration, Backupbliss Clone, Copy-Delete-Posts Duplicate Post, Inisev Enhanced Text Widget, Inisev Redirection, Inisev Rss Redirect \& Feedburner Alternative and 4 more.

How do I fix CVE-2023-3977?

No fix has been published for CVE-2023-3977 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-3977 being exploited?

There is no known exploitation of CVE-2023-3977 in the wild and no public exploit code.

Sources

Also known as GHSA-6jhg-gg85-9xxf.