CVE-2023-3977
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Several WordPress plugins by Inisev are vulnerable to Cross-Site Request Forgery, allowing unauthorized installation of plugins due to a missing nonce check in the handle_installation function. Attackers can exploit this vulnerability to install plugins if they can trick a site administrator.
Risk Assessment
The organization may be exposed to unauthorized installation of malicious plugins, potentially compromising data and system security. Plugins may introduce malicious code, threatening the integrity and confidentiality of data.
Recommendation
It is recommended to update the plugins to the latest versions that include security fixes. Additionally, implementing nonce verification mechanisms in custom AJAX functions is advisable.
Original NVD description (English source)
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.