CVE-2023-7291

Executive Summary

CVE-2023-7291 is a Missing Authorization vulnerability in the Paytium: Mollie payment forms & donations WordPress plugin, affecting versions up to and including 4.3.7. The flaw resides in the create_mollie_account function, which lacks a proper capability check. This allows authenticated attackers with subscriber-level access to set up a Mollie account, effectively bypassing intended administrative restrictions. The vulnerability is classified as High Severity (CVSS 7.1) due to the potential for unauthorized data modification, which could lead to financial fraud or account takeover within the Mollie payment ecosystem.

This is a WordPress ecosystem issue, not related to Apache or Nginx. The plugin is designed to integrate Mollie payment forms and donations into WordPress sites.

Supply Chain & Package Security

This vulnerability is specific to the Paytium WordPress plugin, which is distributed via the official WordPress plugin repository. As a supply chain risk, any site running an affected version is exposed. Since the patch status is UNKNOWN / UNPATCHED, users are advised to disable the plugin until a fix is released. No OSV or GitHub advisory data is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires subscriber-level authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H) – unauthorized creation/modification of Mollie accounts
• Availability Impact: None (A:N)

Threat Level: High. Although the EPSS score is 0.0%, the vulnerability is trivial to exploit once authenticated, and the impact on integrity is severe.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) in the create_mollie_account function of the Paytium plugin. In WordPress, functions that perform sensitive actions (like creating payment accounts) should check for appropriate user capabilities (e.g., manage_options or edit_posts). In this case, the function is accessible via AJAX or direct call without verifying that the user has administrative privileges.

Attack Flow:

1. An attacker registers or compromises a subscriber-level account on the WordPress site.
2. The attacker sends a crafted request to the vulnerable endpoint (likely admin-ajax.php with an action hook) to invoke create_mollie_account.
3. The function executes without checking capabilities, creating a new Mollie account linked to the attacker's Mollie credentials.
4. The attacker can then use this account to process fraudulent payments or redirect donations.

Impact: Unauthorized creation of Mollie accounts can lead to financial theft, loss of donor trust, and potential legal liabilities.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern. The vulnerable function likely looks like:

// Vulnerable code (Paytium <= 4.3.7)
function create_mollie_account() {
    // No capability check
    $mollie_api_key = sanitize_text_field($_POST['mollie_api_key']);
    // ... create account logic ...
    wp_send_json_success(array('account_id' => $new_account_id));
}
add_action('wp_ajax_create_mollie_account', 'create_mollie_account');

A patched version would include a capability check:

// Patched code (hypothetical)
function create_mollie_account() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $mollie_api_key = sanitize_text_field($_POST['mollie_api_key']);
    // ... create account logic ...
    wp_send_json_success(array('account_id' => $new_account_id));
}
add_action('wp_ajax_create_mollie_account', 'create_mollie_account');

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Paytium plugin <= 4.3.7
• Valid subscriber-level credentials (e.g., username: attacker, password: password123)

Exploit Steps:

1. Log in as a subscriber.
2. Obtain a nonce if required (check the plugin's AJAX handler).
3. Send a POST request to wp-admin/admin-ajax.php with the action create_mollie_account and the required parameters (e.g., mollie_api_key).

Proof-of-Concept (PoC) using cURL:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -c cookies.txt -b cookies.txt \
  -d "action=create_mollie_account&mollie_api_key=test_live_xxxxxxxxx&_ajax_nonce=YOUR_NONCE"

Note: No public exploit code is available from Exploit-DB or Nuclei templates.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action create_mollie_account from non-admin users.
• Alert on any creation of Mollie accounts outside of normal administrative workflows.

Hardening:

• Immediately disable the Paytium plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block requests to create_mollie_account from low-privilege users.
• Enforce strict capability checks via custom code or a security plugin.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=create_mollie_account
  • Unusual Mollie API keys being registered (check Mollie dashboard for unexpected accounts)
• File IOCs:
  • Modified or new Mollie account entries in the WordPress database (wp_options or custom tables)
• Log IOCs:
  • WordPress debug logs showing create_mollie_account calls from subscriber-level users
  • Mollie API logs showing account creation from unexpected IPs

Detection Engineering

YARA Rule

rule Detect_Paytium_Missing_Auth_CVE_2023_7291 {
    meta:
        description = "Detects Paytium plugin files with missing capability check in create_mollie_account"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-7291"
        severity = "high"
    strings:
        $func = "function create_mollie_account" nocase
        $ajax = "wp_ajax_create_mollie_account" nocase
        $no_check = "current_user_can" nocase
    condition:
        $func and $ajax and not $no_check
}

Sigma Rule

title: Paytium Plugin Unauthorized Mollie Account Creation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2023-7291 by creating a Mollie account via AJAX without proper authorization.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=create_mollie_account'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-7291 Paytium Unauthorized Mollie Account Creation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=create_mollie_account"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Paytium plugin until an official patch is released.
2. Review Mollie account activity for any unauthorized accounts created.
3. Audit user roles and remove any suspicious subscriber accounts.

Long-term Fix:

• The vendor must add a capability check (e.g., current_user_can('manage_options')) to the create_mollie_account function.
• Implement nonce verification for AJAX actions.

Workarounds:

• Use a security plugin (e.g., Wordfence) to block AJAX requests to create_mollie_account from non-admin users.
• Add custom code to functions.php to restrict the function:

add_action('wp_ajax_create_mollie_account', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 0);

Valters IT – Securing digital ecosystems through intelligence-driven defense.