CVE-2023-7287

Executive Summary

CVE-2023-7287 is a Missing Authorization vulnerability in the Paytium: Mollie payment forms & donations WordPress plugin (versions up to and including 4.3.7). The flaw resides in the pt_cancel_subscription function, which fails to perform a capability check before processing subscription cancellation requests. This allows an authenticated attacker with subscriber-level privileges to cancel any subscription managed by the plugin, potentially disrupting recurring donations or payment plans.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The attack vector is network-based, requires low complexity, and only requires subscriber-level authentication. The CVSS v3.1 base score is 5.4 (Medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a patch makes it a persistent risk for unmaintained sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the absence of a patch means site owners must rely on manual mitigation or plugin replacement. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the ability for low-privileged users to cancel subscriptions makes this a significant operational risk for donation-dependent sites.

Deep Dive & Mechanics

The vulnerability exists in the pt_cancel_subscription AJAX handler within the Paytium plugin. The function is intended to allow administrators or subscription owners to cancel a subscription. However, the code does not verify that the current user has the manage_options capability or that they own the subscription being cancelled. The function only checks for a valid nonce, which can be obtained by any authenticated user.

Attack Flow:

1. An attacker registers or obtains a subscriber-level account on the WordPress site.
2. The attacker identifies the subscription ID of a target subscription (e.g., via enumeration or by observing the subscription list).
3. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=pt_cancel_subscription and the target subscription_id.
4. The plugin processes the cancellation without verifying the user's capabilities, resulting in unauthorized subscription termination.

Root Cause: Missing capability check (current_user_can()) in the pt_cancel_subscription function.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.3.7):

function pt_cancel_subscription() {
    check_ajax_referer( 'pt_cancel_subscription', 'nonce' );
    $subscription_id = sanitize_text_field( $_POST['subscription_id'] );
    // No capability check here
    // ... cancellation logic ...
}

Patched Code (Hypothetical):

function pt_cancel_subscription() {
    check_ajax_referer( 'pt_cancel_subscription', 'nonce' );
    if ( ! current_user_can( 'manage_options' ) && ! pt_is_subscription_owner( get_current_user_id(), $subscription_id ) ) {
        wp_die( 'Unauthorized' );
    }
    $subscription_id = sanitize_text_field( $_POST['subscription_id'] );
    // ... cancellation logic ...
}

The patched version adds a capability check to ensure only administrators or the subscription owner can cancel a subscription.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Paytium plugin <= 4.3.7 installed and active.
• A subscriber-level account (username: attacker, password: attacker123).

Exploitation Steps:

1. Log in as the subscriber and obtain a valid nonce by inspecting the page source or by sending a request to the subscription management page.
2. Identify a target subscription ID (e.g., 123).
3. Send the following cURL command:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=pt_cancel_subscription&subscription_id=123&nonce=VALID_NONCE" \
  -c /tmp/cookies.txt -b /tmp/cookies.txt

Expected Result: The subscription with ID 123 is cancelled, and the attacker receives a success response.

Blue Team

Detection:

• Monitor AJAX requests to /wp-admin/admin-ajax.php with action=pt_cancel_subscription from non-admin users.
• Alert on multiple subscription cancellation attempts from the same user within a short time window.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" action=pt_cancel_subscription
| eval user=extract_field("user", uri)
| search user!="admin"
| stats count by user, src_ip
| where count > 3

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=pt_cancel_subscription and a valid nonce.
• Logs: WordPress debug log entries showing pt_cancel_subscription calls from subscriber-level users.
• File: Presence of Paytium plugin version <= 4.3.7 in /wp-content/plugins/paytium/.
• Behavior: Unexpected cancellation of recurring donations or subscriptions.

Detection Engineering

YARA Rule

rule Detect_Paytium_CVE_2023_7287 {
    meta:
        description = "Detects vulnerable Paytium plugin files with missing capability check"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-7287"
    strings:
        $func = "pt_cancel_subscription" ascii wide nocase
        $missing_check = "check_ajax_referer" ascii wide nocase
        $no_cap = "current_user_can" ascii wide nocase
    condition:
        $func and $missing_check and not $no_cap
}

Sigma Rule

title: Paytium Subscription Cancellation by Unauthorized User
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized subscription cancellation attempts via Paytium plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "action=pt_cancel_subscription"
        cs-username|re: "^(?!admin).*$"
    condition: selection
falsepositives:
    - Legitimate subscription cancellation by subscriber (if plugin is patched)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-7287 Paytium Unauthorized Subscription Cancellation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=pt_cancel_subscription"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Paytium plugin if not essential, or replace it with an alternative donation plugin.
2. Apply a virtual patch using a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=pt_cancel_subscription from non-admin users.
3. Restrict subscriber capabilities using a plugin like "User Role Editor" to remove AJAX access.

Long-Term Fix:

• Since no official patch is available, consider forking the plugin and adding the missing capability check (see patched code example above).
• Monitor the Paytium plugin repository for updates and apply immediately when available.

Valters IT Signature:

This report was generated by Valters IT DevSecOps Framework.
CVE-2023-7287 analysis completed with no known public exploit.