The WordPress plugin WP Custom Admin Interface is a popular tool for customizing your WordPress admin dashboard. Used by thousands of sites to personalize how the backend looks and works, it promises a more branded or streamlined experience for admins and users. However, a recently disclosed security flaw—CVE-2023-47763—shows how a missing authorization check can put your WordPress website at risk, all because of incorrectly configured access control security levels.

In this post, we’ll break down what CVE-2023-47763 is, why it’s dangerous, and show you an example of how attackers might abuse it. Let’s dig in.

What is CVE-2023-47763?

CVE-2023-47763 is a “Missing Authorization” vulnerability found in WP Custom Admin Interface from any version through 7.31. It was reported by Martin Gibson, and essentially means certain actions in the plugin do not properly check if the user has permissions before letting them proceed.

In plain English:
Anyone who’s logged in—sometimes even a user with very basic permissions—can access, modify, or control things they should not be able to. This opens the door for privilege escalation or site takeovers, depending on how the site is set up!

Affected plugin: WP Custom Admin Interface
Vulnerable versions: All versions before and including 7.31

> 👉 _This was officially posted on WPScan and MITRE’s CVE database._

How Does the Vulnerability Work?

WordPress plugins should always check if a user is allowed to perform sensitive actions. For example, only admins should be allowed to change admin menu settings. But in vulnerable versions of WP Custom Admin Interface, the plugin omits these checks in some functions.

Here’s a simplified diagram

Attacker (Subscriber) --[POST /wp-admin/admin-ajax.php?action=caia_save_settings ]--> WP Custom Admin Interface (missing authorization check) --[Settings updated!]

Let’s look at a simplified PHP snippet (not actual plugin code, but it gives the idea)

// This function handles AJAX saving of plugin settings
add_action('wp_ajax_caia_save_settings', 'caia_save_settings_handler');

function caia_save_settings_handler() {
    // MISSING: current_user_can(‘manage_options’) or similar check!
    
    $new_settings = isset($_POST['settings']) ? $_POST['settings'] : [];
    update_option('caia_plugin_settings', $new_settings);
    wp_send_json_success(['message' => 'Settings saved!']);
}

The missing piece?

A secure version might look like this

function caia_save_settings_handler() {
    if ( !current_user_can( 'manage_options' ) ) {
        wp_send_json_error(['message' => 'Permission denied.'], 403 );
        exit;
    }
    // ... continue saving as above
}

Example (using curl on command line)

curl -X POST \
    -d "action=caia_save_settings" \
    -d "settings[admin_menu_hidden]=1" \
    -b "wordpress_logged_in_cookie=..." \
    https://victim-site.com/wp-admin/admin-ajax.php

Where wordpress_logged_in_cookie is the session cookie of a logged-in low-privilege user.

If there are plugin hooks, worse scenarios might occur.

> Tip: Tools like Burp Suite can be used to intercept and replay these admin-ajax.php calls if you want to test in a safe, legal environment.

Regularly audit your WordPress plugins and remove what you don’t use.

3. Use security plugins like Wordfence or WPScan for automatic vulnerability alerts.

More References

- WPScan Vulnerability Detail
- MITRE CVE-2023-47763 entry
- Plugin homepage on WordPress.org

Summary

CVE-2023-47763 is a classic example of why missing authorization checks can have real-world consequences. It’s a reminder for developers to always validate user roles and for site owners to keep everything updated. If you use WP Custom Admin Interface, make sure to upgrade ASAP—or you might be leaving the doors to your admin dashboard wide open!

Timeline

Published on: 12/09/2024 13:15:30 UTC