CVE-2023-47557 - Missing Authorization Vulnerability in wp-buy Visitors Traffic Real Time Statistics Allows Exploiting Incorrectly Configured Access Control Security Levels

A missing authorization vulnerability has been discovered in the plugin "wp-buy Visitors Traffic Real Time Statistics" for WordPress, which allows an attacker to exploit the plugin's incorrectly configured access control security levels. This vulnerability has been assigned the identifier CVE-2023-47557 and affects plugin versions up to and including 7.2.

Background

The "wp-buy Visitors Traffic Real Time Statistics" plugin is a WordPress plugin that provides detailed statistical information on the visitors to a website. It includes real-time visitor tracking, location information, and various other traffic data.

The plugin's developers official webpage provides a complete list of features and contains documentation on how to use the plugin. However, researchers have discovered that some of these features may be improperly secured, allowing for possible attacks by malicious actors.

Vulnerability Details

The vulnerability arises due to missing authorization checks within the plugin's codebase. This means that some functions that should only be accessible to authorized users can be accessed by anyone, regardless of their level of access within the WordPress site.

When exploiting this vulnerability, an attacker can gain unauthorized access to sensitive information, manipulate data in the plugin's database, and even gain more significant control over the WordPress site itself.

Researchers have discovered the following code snippet that demonstrates the issue

function easel_save_postdata( $post_id, $post ) {
    /**
     * Verify if this a valid request
     */
    if ( ! wp_verify_nonce( $_POST['post_settings_noncename'], plugin_basename( __FILE__ ) ) ) {
        return $post->ID;
    }
 
    /**
     * Check permissions
     */
    if ( ! current_user_can( 'edit_post', $post->ID )) {
        return $post->ID;
    }

    // Missing authorization check here!
}

In the code snippet above, the plugin fails to perform an authorization check when updating post data, which allows unauthorized users to perform actions that should only be possible for authorized users.

Exploit Details

To exploit this vulnerability, an attacker would need to find and target a WordPress site running the vulnerable version of the "wp-buy Visitors Traffic Real Time Statistics" plugin. Then, they can craft a malicious request to execute the unauthorized actions.

Please note that this post is for educational purposes only and describes a real-world vulnerability that has been found in the wild. We strongly encourage web administrators to update their "wp-buy Visitors Traffic Real Time Statistics" plugin to the latest version and follow best practices for securing their website.

For more details about this vulnerability and potential mitigation, please refer to the following resources:

1. CVE-2023-47557 - Official CVE Entry
2. WPScan Vulnerability Database Entry
3. Plugin Developer's Official Response and Patch

Conclusion

CVE-2023-47557 highlights the potential risks that come with using third-party plugins in your WordPress site. It is essential to ensure that all plugins are up-to-date and not vulnerable to attacks due to missing authorization checks or other security-related issues.

Keeping your WordPress site secure is an ongoing process requiring continuous monitoring and updates. Make sure to follow best practices, guidelines, and stay informed about emerging threats and vulnerabilities to protect your website and its users.

Timeline

Published on: 01/02/2025 12:15:15 UTC