CVE-2023-6748

Executive Summary

CVE-2023-6748 is a Sensitive Information Exposure vulnerability in the Custom Field Template plugin for WordPress, affecting all versions up to and including 2.6.1. The flaw resides in the [cft] shortcode, which fails to properly restrict access to arbitrary post metadata. An authenticated attacker with at least Contributor-level privileges can exploit this to extract sensitive data, including private post metadata such as hidden fields, API keys, or internal notes stored in custom fields. This vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx.

The CVSS v3.1 base score is 4.3 (Medium), with a low attack complexity and low privileges required. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis. No public proof-of-concept (PoC) code or exploit-db entry exists, but the vulnerability is trivially exploitable via the shortcode.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is not actively maintained, and no patch has been released. Users should consider removing or replacing the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable over HTTP.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Contributor-level access or higher.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Limited to metadata exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential to leak sensitive metadata (e.g., API keys, internal IDs) elevates the risk for sites storing secrets in custom fields.

Deep Dive & Mechanics

The Custom Field Template plugin provides a [cft] shortcode to display custom field values on the front end. The vulnerability arises because the shortcode does not enforce proper authorization checks. When a user with Contributor-level access or higher inserts the shortcode into a post or page, the plugin retrieves and displays the metadata of any post, including private or protected fields, without verifying if the user has permission to view that specific post's metadata.

The shortcode syntax is typically [cft field="field_name" post_id="X"]. By manipulating the post_id parameter, an attacker can enumerate arbitrary posts and extract their custom field data. This includes fields that may contain sensitive information such as:

• API keys or tokens
• Internal notes or comments
• User-specific metadata
• Hidden configuration values

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and maps to MITRE ATT&CK tactic T1552 (Unsecured Credentials).

Vulnerable vs. Patched Code

Vulnerable Code (version 2.6.1): The shortcode handler in custom-field-template.php directly retrieves post metadata without checking user capabilities:

function cft_shortcode($atts) {
    extract(shortcode_atts(array(
        'field' => '',
        'post_id' => get_the_ID()
    ), $atts));
    if (empty($field)) return '';
    $meta = get_post_meta($post_id, $field, true);
    return esc_html($meta);
}

Patched Code (hypothetical fix): A proper fix would add a capability check before returning metadata:

function cft_shortcode($atts) {
    extract(shortcode_atts(array(
        'field' => '',
        'post_id' => get_the_ID()
    ), $atts));
    if (empty($field)) return '';
    // Ensure user can read the target post
    if (!current_user_can('read_post', $post_id)) {
        return '';
    }
    $meta = get_post_meta($post_id, $field, true);
    return esc_html($meta);
}

No official patch exists as the plugin is unmaintained.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Custom Field Template plugin <= 2.6.1
• Authenticated user with Contributor role or higher
• Knowledge of a target post ID and custom field name

Exploitation Steps:

1. Log in as a Contributor-level user.
2. Create or edit a post/page and insert the shortcode: [cft field="secret_key" post_id="123"]
3. Publish or preview the post. The custom field value from post ID 123 will be displayed.
4. Enumerate post IDs and field names to extract additional metadata.

Example Shortcode:

[cft field="api_key" post_id="42"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for shortcode usage in post content by low-privileged users.
• Look for unusual post_id values in shortcodes that do not correspond to the current post.
• Audit custom field names for sensitive keywords (e.g., api_key, password, token).

Hardening:

• Remove or replace the Custom Field Template plugin.
• Restrict Contributor roles from using shortcodes via user role editor plugins.
• Implement a Web Application Firewall (WAF) rule to block shortcodes with suspicious post_id parameters.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/custom-field-template/custom-field-template.php (version <= 2.6.1)
• Shortcode pattern: [cft field="*" post_id="*"] in post content
• Log entries: Unusual post revisions or previews by Contributor users
• Network: HTTP requests to /wp-admin/post.php or /wp-admin/admin-ajax.php with shortcode parameters

Detection Engineering

YARA Rule

rule CVE_2023_6748_WordPress_Custom_Field_Template {
    meta:
        description = "Detects vulnerable Custom Field Template plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-6748"
    strings:
        $shortcode_func = "function cft_shortcode" nocase
        $get_post_meta = "get_post_meta" nocase
        $shortcode_atts = "shortcode_atts" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2023-6748 - Custom Field Template Shortcode Exploitation
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit sensitive information exposure via the [cft] shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'cft'
    condition: selection
falsepositives:
    - Legitimate use of the shortcode by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-6748 - Custom Field Template Shortcode Exploitation"; flow:to_server,established; content:"[cft"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the Custom Field Template plugin immediately.
2. Audit all posts and pages for existing [cft] shortcodes and remove them.
3. Review custom field data for any exposed sensitive information and rotate secrets if necessary.

Long-Term Mitigation:

• Replace the plugin with an actively maintained alternative (e.g., Advanced Custom Fields).
• Implement the principle of least privilege: restrict Contributor roles from using shortcodes.
• Enable WordPress logging and monitor for suspicious shortcode usage.
• Apply a virtual patch via WAF to block requests containing [cft in POST data.

Patch Status: No official patch available. The vendor is unresponsive. Users must manually remediate.

Valters IT
DevSecOps & Cyber Threat Intelligence