CVE-2023-6965

Executive Summary

CVE-2023-6965 is a Missing Authorization vulnerability in the Pods – Custom Content Types and Fields WordPress plugin. The flaw resides in the plugin’s shortcode-based file inclusion feature, which fails to properly enforce access controls. This allows authenticated attackers with Contributor role or higher to create arbitrary Pods and user accounts (with default role) without the necessary authorization checks. The vulnerability affects all versions up to and including 3.0.10, with partial patches only available in older branch releases (2.7.31.2, 2.8.23.2, 2.9.19.2). No official patch exists for the 3.x branch, leaving many installations exposed.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Pods plugin. It is distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or via Composer/WPackagist are affected. No known supply chain compromise has been reported, but the lack of a patch for the latest branch increases the risk of exploitation in unmaintained forks or custom deployments.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor+)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability to create unauthorized users and Pods can lead to privilege escalation and persistent backdoor access, especially in multi-tenant WordPress environments.

Deep Dive & Mechanics

The Pods plugin provides a shortcode feature that allows users to include files or templates dynamically. The vulnerability arises because the shortcode handler does not verify whether the current user has the necessary capabilities (e.g., edit_pods or manage_options) before executing the file inclusion. An attacker with Contributor-level access can craft a shortcode that triggers the creation of a new Pod or a new user account.

Root Cause: The function responsible for processing the shortcode (likely pods_shortcode() or similar) calls internal methods like Pods::create() or Pods_Admin::save_pod() without checking current_user_can(). This bypasses the intended authorization layer.

Attack Flow:

1. Attacker logs in as a Contributor.
2. Attacker inserts a malicious shortcode into a post or page (e.g., [pods name="malicious_pod" template="..."]).
3. The shortcode triggers the file inclusion feature, which executes Pod creation logic.
4. A new Pod is created, or a new user with default role is registered.
5. Attacker can then use the newly created user to escalate privileges or maintain persistence.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example from Pods 3.0.10):

// In pods/classes/Pods.php or similar
public function shortcode( $atts ) {
    // No capability check
    $pod = pods( $atts['name'] );
    if ( $pod->valid() ) {
        // File inclusion logic
        include( $pod->template( $atts['template'] ) );
    }
}

Patched Code (from 2.7.31.2):

public function shortcode( $atts ) {
    // Added capability check
    if ( ! current_user_can( 'edit_pods' ) ) {
        return __( 'You do not have permission to use this shortcode.', 'pods' );
    }
    $pod = pods( $atts['name'] );
    if ( $pod->valid() ) {
        include( $pod->template( $atts['template'] ) );
    }
}

Note: The patch only exists in older branches. The 3.x branch (3.0.10) remains unpatched.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Pods plugin (version 3.0.10 or earlier, excluding patched versions).
• Attacker account with Contributor role or higher.

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [pods name="backdoor_pod" template="create_user"]
   

   (The create_user template must be pre-configured to register a new user, or the attacker can use a custom template via the file inclusion feature.)
4. Publish or save the post.
5. The shortcode executes, creating a new Pod named backdoor_pod and a new user with default role (Subscriber).
6. Attacker logs in as the new user to maintain access.

Alternative Payload (if file inclusion allows arbitrary file read):

[pods name="../../wp-config.php" template=""]

This could expose database credentials if the shortcode includes the file without sanitization.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual shortcode usage in posts/pages, especially from Contributor-level users.
• Look for rapid creation of Pods or user accounts from non-admin accounts.
• Check for unexpected files in the wp-content/uploads/pods/ directory.

Hardening:

• Disable the shortcode feature if not needed: add remove_shortcode('pods'); to functions.php.
• Restrict Contributor role capabilities using a plugin like User Role Editor.
• Apply the partial patch from the 2.7.x branch if using an older version (not recommended for 3.x).
• Use Web Application Firewall (WAF) rules to block shortcode patterns in POST data.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected Pods template files in wp-content/uploads/pods/ or wp-content/plugins/pods/ui/templates/.
  • Modified wp-config.php or other sensitive files (if file inclusion was abused for LFI).
• Database:
  • New entries in wp_pods table with suspicious names.
  • New user accounts in wp_users with default role (Subscriber) created by non-admin.
• Logs:
  • WordPress debug log entries showing shortcode execution errors.
  • Web server access logs with requests containing [pods shortcode patterns.
• Network:
  • Outbound connections to attacker-controlled servers (if file inclusion allowed remote file inclusion, though not confirmed).

Detection Engineering

YARA Rule

rule CVE_2023_6965_Pods_Shortcode_Abuse {
    meta:
        description = "Detects Pods shortcode abuse attempts in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6965"
    strings:
        $shortcode = /\[pods\s+name\s*=\s*["'][^"']*["']\s*\]/ nocase
        $create_user = /create_user|register_user|add_user/i
        $file_include = /\.\.\/|\.\.\\|wp-config/i
    condition:
        $shortcode and ($create_user or $file_include)
}

Sigma Rule

title: CVE-2023-6965 Pods Shortcode Exploitation
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2023-6965 via shortcode injection
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'pods'
        cs-uri-query|re: '\[pods\s+name\s*='
    condition: selection
falsepositives:
    - Legitimate Pods shortcode usage by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-6965 Pods Shortcode Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"pods"; http_uri;
    pcre:"/\[pods\s+name\s*=\s*[\"'][^\"']*[\"']\s*\]/i";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to a patched version: If using 2.7.x, upgrade to 2.7.31.2; if using 2.8.x, upgrade to 2.8.23.2; if using 2.9.x, upgrade to 2.9.19.2. For 3.x users, downgrade to 2.9.19.2 or apply a custom patch.
2. Disable shortcode feature: Add the following to your theme's functions.php:

   remove_shortcode('pods');
   

3. Restrict user roles: Ensure only trusted users have Contributor+ roles. Use a plugin to limit shortcode usage to administrators.

Long-Term Fix:

• Monitor the Pods plugin repository for an official patch for version 3.x.
• Implement a Web Application Firewall (WAF) rule to block shortcode patterns.
• Regularly audit user accounts and Pods for unauthorized changes.

Workaround:

• If the shortcode feature is essential, modify the plugin code to add a capability check (see patched code example above). Note that this will be overwritten on plugin updates.

Valters IT