CVE-2023-6163

Executive Summary

CVE-2023-6163 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Crowdfunding WordPress plugin, affecting versions prior to 2.1.10. The plugin fails to properly sanitize and escape certain settings, allowing high-privilege users (such as administrators) to inject malicious scripts that execute when other users view the affected pages. This is particularly dangerous in multisite WordPress installations where the unfiltered_html capability is disallowed, as it bypasses the intended security restriction. The vulnerability has a CVSS score of 0.0 in the NVD data, but based on the description, a more realistic score is 4.8 (Medium) due to the requirement for high privileges and user interaction.

Supply Chain & Package Security

This vulnerability affects the WP Crowdfunding WordPress plugin, which is distributed via the official WordPress plugin repository. Users should verify they are running version 2.1.10 or later. No known supply chain compromise has been reported, but the plugin's update mechanism should be trusted.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have admin-level access.
• User Interaction (UI): Required (R) – A victim must view the maliciously crafted page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Overall CVSS Score: 4.8 (Medium)

Threat Level: Medium. Exploitation requires admin privileges, but in a multisite environment, a site administrator could compromise other sites.

Deep Dive & Mechanics

The vulnerability resides in the settings page of the WP Crowdfunding plugin. The plugin does not properly sanitize or escape user-supplied input before storing it in the database. When an admin saves a setting containing malicious JavaScript, the script is stored and later rendered without proper escaping in the admin dashboard or frontend. This allows the attacker to execute arbitrary JavaScript in the context of other users' browsers.

The attack flow:

1. An attacker with admin privileges navigates to the plugin's settings page.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into a vulnerable setting field.
3. The plugin stores the payload in the WordPress database without sanitization.
4. When another user (including other admins or site visitors) views the page that renders this setting, the script executes.

In a multisite setup, this is critical because a site admin (who does not have unfiltered_html capability) can still inject XSS, bypassing the intended security control.

Vulnerable vs. Patched Code

Vulnerable Code (before 2.1.10):

// In settings page, directly outputting user input without escaping
echo get_option('wp_crowdfunding_settings')['some_field'];

Patched Code (2.1.10+):

// Properly escaping output
echo esc_html( get_option('wp_crowdfunding_settings')['some_field'] );

The patch uses esc_html() to escape HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress multisite installation with WP Crowdfunding plugin version < 2.1.10.
• Admin credentials for a site (not super admin).

Steps:

1. Log in as a site administrator.
2. Navigate to the WP Crowdfunding settings page (e.g., /wp-admin/admin.php?page=wp-crowdfunding-settings).
3. Locate a vulnerable setting field (e.g., a text input for custom CSS or header text).
4. Inject the following payload:

   <script>alert('XSS by Red Team');</script>
   

5. Save the settings.
6. As a different user (e.g., another admin or subscriber), visit any page that displays the injected setting (e.g., the campaign listing page).
7. The script executes, demonstrating the XSS.

Advanced Payload:

<script>
fetch('/wp-admin/admin-ajax.php?action=some_action&data=stolen_cookies');
</script>

Blue Team

Detection:

• Monitor for unusual changes to plugin settings by high-privilege users.
• Look for script tags in database entries related to wp_crowdfunding_settings.
• Use WAF rules to block common XSS patterns in admin POST requests.

Hunting:

• Query the database for stored XSS indicators:

  SELECT * FROM wp_options WHERE option_name LIKE '%wp_crowdfunding%' AND option_value LIKE '%<script%';
  

• Review server logs for requests to /wp-admin/admin.php?page=wp-crowdfunding-settings with suspicious POST data.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-crowdfunding/wp-crowdfunding.php (check version)
• Database: wp_options table entries containing <script> tags in wp_crowdfunding_settings option.
• Network: POST requests to /wp-admin/admin.php?page=wp-crowdfunding-settings with encoded JavaScript.
• Logs: PHP error logs showing unexpected < in option values.

Detection Engineering

YARA Rule

rule CVE_2023_6163_WP_Crowdfunding_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Crowdfunding settings"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2023-6163"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/si
        $option_name = "wp_crowdfunding_settings"
    condition:
        $option_name and $xss_payload
}

Sigma Rule

title: WP Crowdfunding Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts in WP Crowdfunding plugin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'admin.php?page=wp-crowdfunding-settings'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate admin use of JavaScript in settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-6163 WP Crowdfunding Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin.php?page=wp-crowdfunding-settings"; http_uri;
    content:"<script"; http_client_body;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade WP Crowdfunding to version 2.1.10 or later.
• If upgrade is not possible, restrict admin access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block <script> tags in plugin settings POST requests.

Long-term:

• Enforce the principle of least privilege for WordPress admin roles.
• Regularly audit plugin settings for unexpected changes.
• Use security plugins that monitor file integrity and database changes.

Workaround:

• Disable the WP Crowdfunding plugin until patched.
• Manually sanitize the wp_crowdfunding_settings option in the database using a script.

Valters IT
Securing Digital Frontiers