CVE-2023-7292

Executive Summary

CVE-2023-7292 is a medium-severity vulnerability in the Paytium: Mollie payment forms & donations plugin for WordPress, affecting versions up to and including 4.3.7. The issue lies in the paytium_notice_dismiss function, which lacks a proper capability check. This allows authenticated attackers with subscriber-level access to dismiss admin notices, a privilege that should be reserved for higher-level users like administrators.

While the CVSS score is 4.3 (Medium), the vulnerability is part of the WordPress ecosystem and could be chained with other flaws to disrupt administrative workflows or hide critical warnings from site administrators. The EPSS score is 0.0%, indicating low exploitation likelihood, but the missing capability check is a classic authorization bypass that should be addressed.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify they are running version 4.3.8 or later if a patch becomes available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (dismissal of admin notices)
• Availability Impact: None

Threat Level: Medium. The vulnerability allows low-privileged users to dismiss admin notices, which could hide important security or update notifications from administrators. While not directly exploitable for data theft or remote code execution, it weakens the overall security posture.

Deep Dive & Mechanics

The vulnerability exists in the paytium_notice_dismiss function, which is registered via WordPress AJAX actions. The function is intended to allow administrators to dismiss persistent admin notices. However, the code does not perform a current_user_can('manage_options') or similar capability check before processing the dismissal request.

Root Cause: Missing authorization check (CWE-862). The function only verifies a nonce (which can be obtained by any authenticated user) but does not verify the user's role or capabilities.

Attack Flow:

1. An attacker registers as a subscriber on the WordPress site.
2. The attacker obtains a valid nonce for the paytium_notice_dismiss action (e.g., by inspecting the page source or making a legitimate request).
3. The attacker sends a crafted AJAX request to /wp-admin/admin-ajax.php with action=paytium_notice_dismiss and the nonce.
4. The server processes the request and dismisses the admin notice, even though the attacker should not have this privilege.

Impact: An attacker could dismiss all admin notices, including critical security updates, plugin update warnings, or other alerts that require administrator attention. This could lead to delayed patching or unawareness of security issues.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.3.7):

function paytium_notice_dismiss() {
    check_ajax_referer( 'paytium_notice_dismiss', 'nonce' );
    // Missing capability check
    update_option( 'paytium_dismissed_notices', true );
    wp_die();
}
add_action( 'wp_ajax_paytium_notice_dismiss', 'paytium_notice_dismiss' );

Patched Code (Hypothetical fix):

function paytium_notice_dismiss() {
    check_ajax_referer( 'paytium_notice_dismiss', 'nonce' );
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( 'Unauthorized', 403 );
    }
    update_option( 'paytium_dismissed_notices', true );
    wp_die();
}
add_action( 'wp_ajax_paytium_notice_dismiss', 'paytium_notice_dismiss' );

The fix adds a current_user_can('manage_options') check to ensure only administrators can dismiss notices.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites:

• A WordPress site with Paytium plugin <= 4.3.7 installed.
• A subscriber-level account (username: attacker, password: attacker123).

Steps:

1. Log in as the subscriber and obtain a valid nonce by viewing the page source or making a request to the admin dashboard.
2. Send the following AJAX request using a tool like curl or a browser console:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=paytium_notice_dismiss&nonce=VALID_NONCE_HERE" \
  --cookie "wordpress_logged_in_...=..."

3. Verify that the admin notice is dismissed by checking the paytium_dismissed_notices option in the database.

Expected Output: The admin notice disappears for all users, including administrators.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=paytium_notice_dismiss from non-admin users.
• Look for rapid, repeated dismissal requests that could indicate automated exploitation.

Hardening:

• Apply the patch by adding a capability check to the paytium_notice_dismiss function.
• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php from low-privileged users attempting to access admin-only actions.
• Regularly audit plugin code for missing capability checks.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with body containing action=paytium_notice_dismiss.
• Logs: WordPress debug logs showing paytium_notice_dismiss AJAX calls from subscriber-level users.
• Database: The paytium_dismissed_notices option set to 1 unexpectedly.
• File: No file-based IOCs; this is a logic vulnerability.

Detection Engineering

YARA Rule

rule Paytium_Notice_Dismiss_Missing_Capability {
    meta:
        description = "Detects Paytium plugin versions with missing capability check in paytium_notice_dismiss function"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-7292"
    strings:
        $func = "paytium_notice_dismiss" nocase
        $ajax = "wp_ajax_paytium_notice_dismiss" nocase
        $missing_cap = "check_ajax_referer" nocase
        $no_cap_check = "current_user_can" nocase
    condition:
        $func and $ajax and $missing_cap and not $no_cap_check
}

Sigma Rule

title: Paytium Notice Dismiss by Non-Admin User
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects AJAX requests to dismiss Paytium admin notices from non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-uri-query|contains: action=paytium_notice_dismiss
    condition: selection
falsepositives:
    - Legitimate admin users dismissing notices
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-7292 Paytium Notice Dismiss Attempt"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=paytium_notice_dismiss"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version (e.g., 4.3.8) is available, update immediately. If not, manually patch the code as shown in the "Vulnerable vs. Patched Code" section.
2. Restrict user roles: Ensure only trusted users have subscriber-level access. Consider disabling registration if not needed.
3. Monitor logs: Review WordPress debug logs for unauthorized AJAX calls.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block paytium_notice_dismiss requests from non-admin IPs.
• Conduct regular security audits of all WordPress plugins for missing capability checks.
• Use a security plugin like Wordfence to detect and block unauthorized AJAX actions.

Patch Status: UNKNOWN. The vendor has not released an official patch as of this report. Users are advised to apply the manual fix or disable the plugin until a patch is available.

Report generated by Valters IT DevSecOps & CTI Division
Valters IT