CVE-2023-29427

Executive Summary

CVE-2023-29427 is an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability affecting the TMS Booking for Appointments and Events Calendar – Amelia plugin, a WordPress plugin widely used for appointment scheduling and event management. The vulnerability impacts all plugin versions up to and including 1.0.75, and allows unauthenticated remote attackers to inject malicious JavaScript code into pages rendered by the plugin, which executes within the context of a victim's browser session. Successful exploitation can lead to session hijacking, account takeover, credential theft, and defacement of the WordPress instance. The vendor has issued a patch in version 1.0.76, and organizations running affected versions should prioritize upgrading.

Technical Analysis

Vulnerability Class: Reflected Cross-Site Scripting (XSS)

According to the NVD description, the vulnerability exists in the Amelia plugin version 1.0.75 and earlier. The plugin is designed for booking appointments and managing events calendar functionality within WordPress. Because it is a Reflected XSS flaw and it is exploitable without authentication, the vulnerable parameter handling occurs within a server-side script that reflects user-supplied input back into the HTTP response without adequate sanitization or output encoding.

Attack Surface: The attack surface is the publicly accessible web interface of the WordPress installation. Since the vulnerability is unauthenticated, no prior user credentials or valid session are required for the attacker to craft a malicious URL. The victim only needs to be an authenticated user (administrator, editor, or any user with elevated privileges) who visits the crafted link while logged into the WordPress administrative dashboard or while browsing the public site.

Vulnerability Mechanism: In a reflected XSS attack, the attacker crafts a URL containing malicious script payloads within query parameters or form values. When the vulnerable plugin processes the request and includes this input in the generated HTML response without proper encoding, the browser interprets the embedded script as executable code. Because the plugin is active across all pages where its shortcodes or widgets are rendered, the vulnerable reflection point could exist in any booking form, calendar display, or appointment confirmation page generated by the plugin.

The CVSS score of 7.1 places this vulnerability in the High severity range, reflecting the fact that while the attack requires victim interaction (clicking a malicious link), the impact on confidentiality and integrity is significant — an attacker can steal session tokens, capture keystrokes, modify page content, and potentially perform privileged actions on behalf of the authenticated victim.

Insufficient Technical Detail: Specific vulnerable parameters, function names, and code paths are not disclosed in the NVD description or CNA title. Insufficient technical detail is available to enumerate the exact input fields or reflection points. The attack mechanism is therefore described at the vulnerability-class level, consistent with the data provided.

Exploitation Scenarios

No public PoC is available, and no Nuclei template or exploit code has been identified. The attack chain below is inferred from the vulnerability class (Reflected XSS) and the published description.

Step 1 — Reconnaissance / Target Identification: An attacker identifies WordPress sites running the Amelia plugin. The attacker can detect the plugin by examining page source code for plugin-specific markers (e.g., script identifiers, stylesheet URLs containing "amelia"), or by probing known booking endpoint paths that the plugin exposes. Tools such as WPScan or custom fingerprinting scripts can be used to enumerate the plugin version and confirm that the version is 1.0.75 or earlier.

Step 2 — Triggering the Flaw: The attacker crafts a malicious URL that includes a JavaScript payload embedded in a vulnerable parameter that the plugin reflects in the HTML response. Because no authentication is required to trigger the reflection, the attacker does not need to interact with the target server beyond sending the crafted request. The attacker may validate the reflection exists by submitting a non-malicious test payload (e.g., "><svg/onload=alert(1)>) and observing whether it is echoed unencoded in the response body.

Step 3 — Payload Delivery / Execution: The attacker distributes the crafted URL via phishing emails, fake forum posts, direct messages on social media, or by embedding it in an iframe on a third-party site. The victim must be logged into the WordPress administration interface (or have an active session with privileged capabilities on the site). When the victim clicks the link, the browser sends the request to the vulnerable server, and the response includes the attacker-controlled JavaScript. The browser executes the script within the context of the victim's session and the site's origin.

Step 4 — Post-Exploitation Impact: The executed JavaScript can perform a variety of malicious actions, including: stealing the victim's session cookies and transmitting them to an attacker-controlled server; issuing administrative requests on behalf of the victim (e.g., creating new admin users, modifying plugin settings, injecting backdoor content); capturing keystrokes or form submissions (including credentials); and defacing the public site by altering rendered content. The impact is compounded when the victim is a WordPress administrator, as the attacker effectively gains administrative privileges through the compromised browser session.

Impact Assessment

The CVSS score of 7.1 (High severity) reflects the following impact profile:

• Confidentiality Impact: High — An attacker can read sensitive data exposed in the victim's browser session, potentially including administrative tokens, private user information, and other content accessible to the victim's account. The attacker can also exfiltrate data via network requests to attacker-controlled servers.
• Integrity Impact: High — The attacker can modify page content rendered to the victim, alter application state, create or delete users (if the victim is an administrator), and plant persistent content on the site.
• Availability Impact: Low — Direct availability disruption is not the primary goal; however, an attacker could degrade the site's functionality or lock out legitimate administrators by tampering with accounts, which indirectly affects availability.

Affected Systems: All WordPress installations running the Amelia plugin version 1.0.75 or earlier. The plugin is widely used by service-based businesses (salons, clinics, consulting firms) for appointment booking, enlarging the attack surface to thousands of production sites.

Blast Radius: Because the attack is unauthenticated on the network level and requires only a victim to click a link, the exploit surface is broad. A single compromised administrator session can cascade into full site compromise, plugin backdooring, and lateral movement into other services sharing credentials or integrations. The EPSS score of 0.00410 places this CVE in the moderate-to-low probability of exploitation in the wild, and it is not listed in CISA's Known Exploited Vulnerabilities catalog, suggesting no confirmed active exploitation campaigns at the time of writing.

Detection Guidance

It is important to understand that detection of reflected XSS can focus on two angles: the attacker's delivery attempt (HTTP request containing script payloads) and the victim's browser behavior (outbound requests to exfiltration domains). The following detections are designed to be adapted with organization-specific context (domain names, allowed parameters, etc.).

Sigma Rule

title: Reflected XSS Attempt Against WordPress Amelia Plugin
id: 8c4f1a5e-6d63-4b2a-9e83-72f1a4d8c021
status: experimental
description: Detects HTTP requests containing JavaScript payload indicators in query parameters targeting WordPress Amelia plugin paths.
author: Valters IT Threat Intelligence
date: 2024/06/15
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for WordPress sites running Amelia plugin'
detection:
    selection:
        c-uri|contains:
            - 'amelia'
        c-uri-query|contains:
            - '<script'
            - '<img'
            - '<svg'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - 'alert('
            - 'document.cookie'
            - 'fetch('
            - 'XMLHttpRequest'
    condition: selection
    timeframe: 10m
level: high
falsepositives:
    - Legitimate embedding of user-provided code snippets in admin testing environments
    - Security scanners (if present in environment)
tags:
    - attack.t1059.007
    - attack.t1189
    - cve.2023.29427

YARA Rule

rule CVE_2023_29427_Amelia_Reflected_XSS
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects JavaScript XSS payloads targeting WordPress Amelia plugin reflection points"
        cve = "CVE-2023-29427"
        severity = "high"
        date = "2024-06-15"
    strings:
        $a1 = "amelia" nocase
        $b1 = "<script" nocase
        $b2 = "<img" nocase
        $b3 = "<svg" nocase
        $b4 = "onerror=" nocase
        $b5 = "onload=" nocase
        $b6 = "javascript:" nocase
        $b7 = "document.cookie" nocase
        $b8 = "alert(" nocase
        $b9 = "fetch(" nocase
        $b10 = "XMLHttpRequest" nocase
        $b11 = "eval(" nocase
        $b12 = "fromCharCode" nocase
    condition:
        any of ($a*) and 2 of ($b*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS CVE-2023-29427 WordPress Amelia Plugin Reflected XSS Attempt";
    flow:to_server,established;
    content:"amelia"; http_uri; nocase;
    content:"<script"; http_uri; nocase;
    content:"document.cookie"; http_uri; nocase;
    pcre:"/(<script|<img|<svg|onerror=|onload=|javascript:|document\.cookie|alert\(|fetch\(|XMLHttpRequest)/i";
    classtype:web-application-attack;
    sid:2023294;
    rev:1;
    metadata:created_at 2024-06-15, updated_at 2024-06-15, cve CVE-2023-29427;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.type == "connection" and destination.port == 80 or destination.port == 443]
  [http where event.action == "request" and
     url.path contains "amelia" and
     (url.query contains "<script" or
      url.query contains "<img" or
      url.query contains "<svg" or
      url.query contains "onerror=" or
      url.query contains "onload=" or
      url.query contains "javascript:" or
      url.query contains "document.cookie" or
      url.query contains "alert(" or
      url.query contains "fetch(" or
      url.query contains "XMLHttpRequest")]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri, "%amelia%")
| rex field=uri "^[^?]*\?(?<query>.*)$"
| where 
    like(query, "%<script%") OR 
    like(query, "%<img%") OR 
    like(query, "%<svg%") OR 
    like(query, "%onerror=%") OR 
    like(query, "%onload=%") OR 
    like(query, "%javascript:%") OR 
    like(query, "%document.cookie%") OR 
    like(query, "%alert(%") OR 
    like(query, "%fetch(%") OR 
    like(query, "%XMLHttpRequest%")
| stats count by src_ip, uri, dest, _time
| sort - _time
| rename src_ip AS "Source IP", uri AS "Request URI", dest AS "Destination Host"

Wazuh OSSEC Rule

<group name="web,wordpress,amelia,xss,">
    <rule id="100294" level="10" frequency="6" timeframe="300">
        <if_matched_sid>31100</if_matched_sid>
        <match>amelia</match>
        <regex>/(<script|<img|<svg|onerror=|onload=|javascript:|document\.cookie|alert\(|fetch\(|XMLHttpRequest)/i</regex>
        <description>CVE-2023-29427: Reflected XSS payload detected in request targeting WordPress Amelia plugin</description>
        <options>no_full_log</options>
        <mitre>
            <id>T1059.007</id>
            <id>T1189</id>
        </mitre>
        <group>attack_execution,attack_initial_access,xss,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — a single source (the CNA) claims a patch exists in version 1.0.76; this has not been independently confirmed by a second source at the time of writing.

1) Immediate Mitigations (before patching)

• Upgrade immediately if you have not already applied version 1.0.76 or higher. The patch is the only reliable remediation given that no official workarounds or vendor-supplied configuration hardening are documented.
• If upgrade is not possible in the immediate term, implement a Web Application Firewall (WAF) rule (modsecurity, AWS WAF, Cloudflare, or equivalent) to block requests containing common XSS payload markers (<script, onerror=, javascript:, etc.) in query strings that target any path containing amelia.
• Restrict access to the WordPress administrative interface using IP allowlisting or a VPN to reduce the likelihood of a victim having an active admin session that can be exploited.
• Conduct a full audit of active user sessions and review account activity for anomalies, as previous exploitation cannot be ruled out.

2) Patch / Upgrade Steps

1. Log into the WordPress administrative dashboard.
2. Navigate to Plugins → Installed Plugins.
3. Locate the Amelia plugin entry.
4. If an update notification is present, click Update Now. Alternatively, download the updated plugin package from the official WordPress plugin repository or the vendor's site and replace the existing plugin directory via FTP/SSH.
5. Verify the installed version is 1.0.76 or higher.
6. Clear WordPress object caches (if a caching plugin is active) and the browser cache.
7. Re-run a vulnerability scan (e.g., WPScan) to confirm the plugin version no longer matches the vulnerable range.

3) Long-Term Hardening

• Enforce a policy of timely plugin updates; enable automatic background updates for plugins in WordPress where feasible.
• Apply the principle of least privilege: ensure administrative accounts are used only for administrative tasks, and reduce the number of users with elevated roles.
• Implement Content Security Policy (CSP) headers at the web server level to restrict the execution of inline scripts and limit the damage surface of any future XSS vulnerabilities.
• Regularly harden the WordPress installation: disable file editing, remove unused plugins/themes, and restrict access to wp-admin via network-level controls.
• Monitor the vendor's security advisories and subscribe to WordPress security mailing lists to stay notified of future patches.
• Maintain a backup and tested restoration procedure so that a compromised site can be rolled back to a clean state.