CVE-2023-4637

Executive Summary

CVE-2023-4637 is a Missing Authorization vulnerability in the WPvivid WordPress plugin (versions up to and including 0.9.94). The plugin fails to perform a capability check on the restore() and get_restore_progress() AJAX functions, allowing unauthenticated attackers to invoke these functions. If an attacker possesses a valid backup ID (which can be enumerated or guessed), they can trigger these functions and obtain full file paths, leading to information disclosure. This vulnerability is classified as CWE-862: Missing Authorization and has a CVSS score of 4.3 (Medium). The EPSS probability is 0.0%, indicating low active exploitation in the wild, but the lack of a patch makes it a persistent risk for unhardened WordPress installations.

Supply Chain & Package Security

This vulnerability affects the WPvivid WordPress plugin, distributed via the official WordPress plugin repository. Since no patch has been released, users must rely on manual mitigation or removal. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): Low (L) – Only file paths are disclosed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the direct impact is limited to information disclosure, the exposed file paths can aid attackers in further reconnaissance and exploitation of other vulnerabilities.

Deep Dive & Mechanics

The WPvivid plugin registers AJAX actions for restore() and get_restore_progress() without checking user capabilities. In WordPress, AJAX actions intended for authenticated users should include a current_user_can() check. The vulnerable code does not enforce this, allowing any unauthenticated visitor to call these functions.

The restore() function expects a backup ID parameter. If an attacker can guess or enumerate a valid backup ID (e.g., via brute-force or by observing backup naming patterns), they can invoke the function. The get_restore_progress() function then returns the progress of the restore operation, which includes full file paths on the server.

Attack Flow:

1. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=wpvivid_restore and a backup_id parameter.
2. The plugin processes the request without authentication.
3. If the backup ID is valid, the restore process begins, and the attacker can poll get_restore_progress() to obtain file paths.
4. The attacker uses the disclosed paths for further attacks (e.g., LFI, path traversal).

Vulnerable vs. Patched Code

Vulnerable Code (wpvivid-backuprestore/includes/class-wpvivid-restore.php):

add_action('wp_ajax_wpvivid_restore', array($this, 'restore'));
add_action('wp_ajax_nopriv_wpvivid_restore', array($this, 'restore')); // Missing capability check

Patched Code (hypothetical fix):

add_action('wp_ajax_wpvivid_restore', array($this, 'restore'));
// Remove the nopriv action to require authentication
// Or add capability check inside the function:
public function restore() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // ... rest of function
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WPvivid plugin <= 0.9.94 installed and active.
• A valid backup ID (can be obtained by creating a backup or via enumeration).

Exploitation Steps:

1. Enumerate backup IDs by observing backup naming patterns (e.g., wpvivid_backup_2023_01_01_123456).
2. Send a POST request to trigger the restore:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=wpvivid_restore&backup_id=wpvivid_backup_2023_01_01_123456"

3. Poll the progress endpoint to obtain file paths:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=wpvivid_get_restore_progress&backup_id=wpvivid_backup_2023_01_01_123456"

4. The response will contain full file paths (e.g., /var/www/html/wp-content/uploads/...).

Note: No public exploit code is available for this CVE.

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action=wpvivid_restore or action=wpvivid_get_restore_progress from unauthenticated sources.
• Look for repeated requests with different backup_id values (brute-force attempts).

Hunting:

• Search web server logs for POST /wp-admin/admin-ajax.php with action=wpvivid_restore and no Cookie header (indicating unauthenticated access).
• Check for backup IDs in logs that do not correspond to legitimate backup events.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with parameters action=wpvivid_restore and backup_id.
  • POST requests to /wp-admin/admin-ajax.php with parameters action=wpvivid_get_restore_progress and backup_id.
• File IOCs:
  • Unexpected backup files in /wp-content/uploads/wpvividbackups/ that were not initiated by an admin.
• Log IOCs:
  • Web server logs showing admin-ajax.php requests from IPs not associated with known admin sessions.

Detection Engineering

YARA Rule

rule CVE_2023_4637_WPvivid_Unauthorized_Access {
    meta:
        description = "Detects attempts to exploit CVE-2023-4637 in WPvivid plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-4637"
    strings:
        $ajax_restore = "action=wpvivid_restore" ascii wide nocase
        $ajax_progress = "action=wpvivid_get_restore_progress" ascii wide nocase
        $backup_id = "backup_id=" ascii wide nocase
    condition:
        any of ($ajax_*) and $backup_id
}

Sigma Rule

title: CVE-2023-4637 WPvivid Unauthenticated AJAX Access
id: 8f4a2b1c-3d5e-4f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects unauthenticated access to WPvivid restore AJAX actions
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=wpvivid_restore'
            - 'action=wpvivid_get_restore_progress'
        cs-uri-query|contains: 'backup_id='
    condition: selection
falsepositives:
    - Legitimate admin actions (should have authentication cookie)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-4637 WPvivid Unauthenticated AJAX Access"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=wpvivid_restore"; http.client_body; content:"backup_id="; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPvivid plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with action=wpvivid_restore or action=wpvivid_get_restore_progress.
3. Restrict access to /wp-admin/ via IP whitelisting or VPN.

Long-term Fix:

• Monitor the WPvivid plugin repository for an official patch.
• Consider migrating to an alternative backup plugin with proper authorization checks.

Workaround (Code-Level):

• Add a capability check to the plugin's functions manually (if you have code access):

add_action('wp_ajax_wpvivid_restore', 'wpvivid_restore_authorized');
function wpvivid_restore_authorized() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // Call original function
}

Valters IT