CVE-2023-0958 — Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is call…
Published: 2023-07-28 · CVSS: 4.3 · CVSS 3.1
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7