CVE-2023-7294

Executive Summary

CVE-2023-7294 is a Missing Authorization vulnerability in the Paytium: Mollie payment forms & donations WordPress plugin (versions up to and including 4.3.7). The flaw resides in the create_mollie_profile function, which lacks a proper capability check. This allows authenticated attackers with subscriber-level access to create unauthorized Mollie payment profiles, leading to unauthorized data modification. The vulnerability has a CVSS score of 7.1 (High) and an EPSS score of 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any future patches immediately. Since the vendor’s patch status is unknown, manual code review or disabling the plugin may be necessary.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Base Score: 7.1 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: None

Threat Level: High – An attacker with minimal privileges can create payment profiles, potentially leading to fraudulent transactions or data manipulation.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) in the create_mollie_profile AJAX handler. The function is intended for administrators to set up Mollie payment profiles, but it does not verify the user’s capabilities before execution. An authenticated user with subscriber-level access can call this function via a crafted request, bypassing intended access controls.

Root Cause: The create_mollie_profile function is registered as an AJAX action for both authenticated and unauthenticated users, but the capability check (e.g., current_user_can('manage_options')) is missing.

Attack Flow:

1. Attacker logs in as a subscriber.
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=create_mollie_profile and required parameters (e.g., profile name, API keys).
3. The plugin processes the request and creates a new Mollie payment profile without verifying the user’s role.
4. The attacker can then use this profile to process payments or redirect funds.

Vulnerable vs. Patched Code

Vulnerable Code (Paytium <= 4.3.7):

add_action('wp_ajax_create_mollie_profile', 'create_mollie_profile');
function create_mollie_profile() {
    // No capability check
    $profile_name = sanitize_text_field($_POST['profile_name']);
    // ... create profile logic
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_create_mollie_profile', 'create_mollie_profile');
function create_mollie_profile() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $profile_name = sanitize_text_field($_POST['profile_name']);
    // ... create profile logic
}

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit exists, a manual exploitation approach is described:

1. Prerequisites: Valid WordPress subscriber account.
2. Craft Request:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: wordpress_logged_in_<hash>=<session>
   
   action=create_mollie_profile&profile_name=attacker_profile&api_key=test_live_xxxxxxxx
   

3. Verify: Check if the profile appears in the Mollie dashboard or plugin settings.

Blue Team (Detection & Hardening)

• Monitor AJAX Requests: Log all admin-ajax.php requests with action=create_mollie_profile from non-admin users.
• Capability Check: Implement a custom plugin or Wordfence rule to block requests to this action from users without manage_options.
• Audit Logs: Enable WordPress audit logging to track profile creation events.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=create_mollie_profile from low-privilege users.
• File: Unexpected Mollie profile entries in the wp_options table (e.g., paytium_mollie_profiles).
• Log: WordPress debug log entries showing create_mollie_profile calls from subscriber roles.

Detection Engineering

YARA Rule

rule CVE_2023_7294_Paytium_Missing_Auth {
    meta:
        description = "Detects Paytium plugin files with missing capability check in create_mollie_profile"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-7294"
    strings:
        $func = "create_mollie_profile" ascii wide
        $ajax = "wp_ajax_create_mollie_profile" ascii wide
        $cap_check = "current_user_can" ascii wide
    condition:
        $func and $ajax and not $cap_check
}

Sigma Rule

title: Paytium Missing Authorization - create_mollie_profile
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized AJAX requests to create_mollie_profile from non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=create_mollie_profile'
    filter:
        cs-username|contains: 'admin'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-7294 Paytium Missing Authorization - create_mollie_profile";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=create_mollie_profile"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the Paytium plugin until a patch is available.
2. Short-term: Implement a custom capability check via a WordPress mu-plugin:

   add_action('wp_ajax_create_mollie_profile', function() {
       if (!current_user_can('manage_options')) {
           wp_die('Unauthorized', 403);
       }
   }, 0);
   

3. Long-term: Monitor the plugin repository for updates and apply patches immediately.
4. Compensating Controls: Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=create_mollie_profile from non-admin IPs.

Valters IT
DevSecOps & Cyber Threat Intelligence