CVE-2023-1730
📋 TL;DR
CVE-2023-1730 is a critical SQL injection vulnerability in the SupportCandy WordPress plugin. Unauthenticated attackers can exploit this to execute arbitrary SQL commands on affected WordPress sites. Any WordPress installation using SupportCandy plugin versions before 3.1.5 is vulnerable.
💻 Affected Systems
- SupportCandy WordPress Plugin
📦 What is this software?
Supportcandy by Supportcandy
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, remote code execution, and full site takeover.
Likely Case
Data exfiltration including user credentials, sensitive support tickets, and potential administrative access.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only read access to non-sensitive data.
🎯 Exploit Status
SQL injection vulnerabilities in WordPress plugins are commonly weaponized. Public proof-of-concept exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.5
Vendor Advisory: https://wordpress.org/plugins/supportcandy/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find SupportCandy plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 3.1.5+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable SupportCandy Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate supportcandy
Web Application Firewall Rule
allBlock SQL injection patterns targeting SupportCandy endpoints
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WordPress instance
- Deploy web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → SupportCandy version. If version is below 3.1.5, you are vulnerable.Check Version:
wp plugin get supportcandy --field=versionVerify Fix Applied:
Verify SupportCandy plugin version is 3.1.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in WordPress/database logs
- Multiple failed login attempts after SQL errors
- Unexpected database schema changes
Network Indicators:
- HTTP requests with SQL injection patterns to /wp-admin/admin-ajax.php
- Unusual outbound database connections from web server
SIEM Query:
source="wordpress.log" AND ("sql" OR "database error" OR "wp-supportcandy")