CVE-2023-6959

Executive Summary

CVE-2023-6959 is a Missing Authorization vulnerability in the Getwid – Gutenberg Blocks WordPress plugin, affecting all versions up to and including 2.0.3. The flaw resides in the recaptcha_api_key_manage function, which lacks a capability check, allowing authenticated attackers with subscriber-level access or higher to add, modify, or delete the 'Recaptcha Site Key' and 'Recaptcha Secret Key' settings. This unauthorized modification can lead to the redirection of form submissions or the disabling of reCAPTCHA protections, potentially enabling spam or phishing attacks.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Getwid plugin is distributed via the official WordPress plugin repository. No supply chain compromise has been reported, but the lack of a patch increases the risk of exploitation in unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (low privileges, no user interaction) and the potential for abuse (e.g., disabling reCAPTCHA to facilitate spam) elevate the risk in real-world scenarios.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). The recaptcha_api_key_manage function in the Getwid plugin is registered via WordPress AJAX actions, intended to allow administrators to update reCAPTCHA keys. However, the function does not perform a current_user_can() check or any capability verification before processing the request.

Affected Code Path:

• The function is hooked to wp_ajax_getwid_recaptcha_api_key_manage.
• An authenticated user with any role (including subscriber) can send a POST request to /wp-admin/admin-ajax.php with the action getwid_recaptcha_api_key_manage and the parameters recaptcha_site_key and recaptcha_secret_key.
• The plugin then updates the WordPress options getwid_recaptcha_site_key and getwid_recaptcha_secret_key without verifying the user's capabilities.

Impact:

• An attacker can set arbitrary reCAPTCHA keys, effectively taking over the reCAPTCHA functionality.
• If the site uses reCAPTCHA on forms (e.g., login, registration, comments), the attacker can disable protection or redirect form submissions to their own reCAPTCHA account, capturing user interactions or bypassing security.

Vulnerable vs. Patched Code

Vulnerable Code (Getwid <= 2.0.3):

add_action('wp_ajax_getwid_recaptcha_api_key_manage', 'recaptcha_api_key_manage');

function recaptcha_api_key_manage() {
    // No capability check
    if (isset($_POST['recaptcha_site_key'])) {
        update_option('getwid_recaptcha_site_key', sanitize_text_field($_POST['recaptcha_site_key']));
    }
    if (isset($_POST['recaptcha_secret_key'])) {
        update_option('getwid_recaptcha_secret_key', sanitize_text_field($_POST['recaptcha_secret_key']));
    }
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_getwid_recaptcha_api_key_manage', 'recaptcha_api_key_manage');

function recaptcha_api_key_manage() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    if (isset($_POST['recaptcha_site_key'])) {
        update_option('getwid_recaptcha_site_key', sanitize_text_field($_POST['recaptcha_site_key']));
    }
    if (isset($_POST['recaptcha_secret_key'])) {
        update_option('getwid_recaptcha_secret_key', sanitize_text_field($_POST['recaptcha_secret_key']));
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Getwid plugin version <= 2.0.3.
• An authenticated user account with subscriber-level access or higher.

Exploitation Steps:

1. Obtain a valid WordPress nonce for the AJAX action (if required; the vulnerable function may not check nonces either, but typically WordPress AJAX actions require a nonce. In this case, the nonce is not validated, so any valid user session works).
2. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: getwid_recaptcha_api_key_manage
   • recaptcha_site_key: attacker_controlled_key
   • recaptcha_secret_key: attacker_controlled_secret

Example using cURL:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=getwid_recaptcha_api_key_manage&recaptcha_site_key=6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI&recaptcha_secret_key=6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe" \
  --cookie "wordpress_logged_in_xxx=attacker_session_cookie"

Expected Outcome: The reCAPTCHA keys are updated to attacker-controlled values, allowing the attacker to intercept or disable reCAPTCHA challenges.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with the action getwid_recaptcha_api_key_manage from non-admin users.
• Alert on changes to the WordPress options getwid_recaptcha_site_key and getwid_recaptcha_secret_key outside of normal administrative activity.

Hunting:

• Search for logs containing getwid_recaptcha_api_key_manage in the last 30 days.
• Review user role assignments; any subscriber who triggered this action is likely compromised.

Mitigation:

• Immediately update the plugin if a patched version becomes available.
• As a workaround, add a capability check via a custom plugin or code snippet:

add_action('wp_ajax_getwid_recaptcha_api_key_manage', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 1);

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/getwid/includes/recaptcha.php (or similar) – presence of the vulnerable function.
• Database: Option names getwid_recaptcha_site_key and getwid_recaptcha_secret_key with unexpected values.
• Network: POST requests to /wp-admin/admin-ajax.php with action=getwid_recaptcha_api_key_manage from low-privilege users.
• Log: WordPress debug log entries showing recaptcha_api_key_manage calls from non-admin users.

Detection Engineering

YARA Rule

rule CVE_2023_6959_Getwid_Missing_Auth {
    meta:
        description = "Detects vulnerable Getwid plugin code with missing capability check"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6959"
    strings:
        $func = "recaptcha_api_key_manage"
        $ajax = "wp_ajax_getwid_recaptcha_api_key_manage"
        $no_check = "current_user_can" nocase
    condition:
        $func and $ajax and not $no_check
}

Sigma Rule

title: CVE-2023-6959 Getwid reCAPTCHA Key Modification
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized modification of Getwid reCAPTCHA keys via AJAX
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: POST
        cs-uri-query: 
            - '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=getwid_recaptcha_api_key_manage'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-6959 Getwid reCAPTCHA Key Modification Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=getwid_recaptcha_api_key_manage"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Getwid plugin if not essential, or restrict access to the AJAX endpoint via a web application firewall (WAF) rule.
2. Add a capability check using a custom plugin or code snippet as shown in the Blue Team section.
3. Audit user accounts for any unauthorized changes to reCAPTCHA keys.

Long-Term Fix:

• The vendor must release a patched version that includes a current_user_can('manage_options') check in the recaptcha_api_key_manage function.
• Until then, consider replacing the Getwid plugin with an alternative that properly handles authorization.

Workaround:

• Use a WAF to block POST requests to admin-ajax.php containing action=getwid_recaptcha_api_key_manage from non-admin IPs or user agents.

Valters IT
Securing WordPress, One Plugin at a Time