---

A major issue was uncovered in an old—but still widely used—WordPress plugin called “Youtube SpeedLoad”, developed by Alexufo. If you have version .6.3 or older installed, your site could have been left open to a dangerous type of attack called Cross-Site Request Forgery (CSRF). Let’s look at how this bug works, what it means for your website, and how hackers could have used it.

What is CVE-2023-47688?

CVE-2023-47688 refers to a security bug in the Youtube SpeedLoad plugin—a tool meant to speed up sites using YouTube videos by lazy-loading them. The bug, a CSRF vulnerability, exists in all versions up to and including .6.3. In basic terms, it allowed an attacker to trick a logged-in WordPress admin into performing actions they never intended, such as changing plugin settings.

Here is the official NVD page.

How Does This CSRF Vulnerability Work?

Software developers usually protect forms and important request actions in WordPress using nonces (special numbers that change every time). But the Youtube SpeedLoad plugin didn't always check these nonces, especially on its settings page.

Imagine you’re a WordPress admin and you visit a malicious website while being logged in to your site. The evil website could send a crafted HTTP POST request (or hidden form) to your WordPress site behind the scenes. Since WordPress recognizes you as a logged-in admin, it would accept the request and change plugin settings without you knowing.

Suppose this is the vulnerable endpoint in the plugin

// Inside plugin's admin/settings page (youtube-speedload.php)

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // No nonce or capability checks
    update_option('ysl_option_x', $_POST['ysl_option_x']);
    // ... other sensitive operations
    echo "Settings updated!";
}

In this setup, a simple POST request to the plugin’s admin page could change the plugin’s configuration. No token or nonce is required—that’s the problem.

Now, a hacker can create a malicious web page like this

<form action="https://victimsite.com/wp-admin/options-general.php?page=youtube-speedload"; method="POST" id="csrf_form">
  <input type="hidden" name="ysl_option_x" value="evil_value">
</form>
<script>
// When an admin lands here, the form auto-submits, changing the site’s behavior
document.getElementById('csrf_form').submit();
</script>

When an admin already logged into their WordPress site visits this evil page, the browser sends the form without the admin even seeing it. The plugin, not expecting foul play, updates its settings.

Change Youtube settings: Display embarrassing or dangerous videos.

- Embed code or links: If the plugin’s options accept HTML or JavaScript, an attacker could attempt to introduce cross-site scripting.

- Lay groundwork for further attacks: If another vulnerability exists (like XSS), CSRF can help trigger it.

Fix Status

The developer was notified, and in later versions (after .6.3), a proper CSRF/nonces check was implemented to prevent such issues. If you’re using anything below version .6.4, update immediately.

Official fix: Check for check_admin_referer() or similar nonce in action handlers.

if (isset($_POST['ysl_option_x']) && check_admin_referer('ysl_settings_save','ysl_nonce')) {
    update_option('ysl_option_x', $_POST['ysl_option_x']);
    echo "Settings updated!";
} else {
    echo "Security check failed.";
}

*Now, the plugin only changes settings when it sees a valid nonce, preventing CSRF.*

Never reuse code copied from random sources—always add proper nonce checks!

4. Browse carefully, especially when logged into admin panels. Malicious CSRF exploits rely on your browser being authenticated elsewhere.

Resources

- Official Plugin Page
- CVE Report on NVD
- WordPress Nonces Documentation
- What is CSRF? (OWASP)


Conclusion:
CSRF bugs like CVE-2023-47688 happen quietly, but their results can be severe. This shows why developers must always use nonces and why site owners need to patch regularly. Don’t let simple mistakes open the door for hackers!

Timeline

Published on: 11/16/2023 22:15:00 UTC
Last modified on: 11/23/2023 03:42:00 UTC