Login Sign Up

CVE-2023-2188

7.2 HIGH
SQL Injection

📋 TL;DR

This SQL injection vulnerability in Colibri Page Builder for WordPress allows authenticated administrators to inject malicious SQL queries through the 'post_id' parameter. Attackers can extract sensitive database information like user credentials or site data. Only WordPress sites using vulnerable versions of this specific plugin are affected.

💻 Affected Systems

Products:
  • Colibri Page Builder for WordPress
Versions: Up to and including version 1.0.227
Operating Systems: All operating systems running WordPress
Default Config Vulnerable: ⚠️ Yes
Notes: Requires authenticated administrator access to exploit. All WordPress installations with the vulnerable plugin version are affected regardless of OS.

📦 What is this software?

Colibri Page Builder by Extendthemes

View all CVEs affecting Colibri Page Builder →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including extraction of all user credentials, sensitive site data, and potential privilege escalation to full site control.

🟠

Likely Case

Data exfiltration of sensitive information from the WordPress database, potentially including user emails, hashed passwords, and site configuration data.

🟢

If Mitigated

Limited impact with proper access controls and monitoring, potentially only affecting non-sensitive data tables.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires administrator credentials but uses simple SQL injection techniques. The vulnerability is well-documented in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 1.0.228 and later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2922722/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Colibri Page Builder. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.0.228+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Remove vulnerable plugin

all

Temporarily disable or remove the Colibri Page Builder plugin until patched

wp plugin deactivate colibri-page-builder
wp plugin delete colibri-page-builder

Restrict administrator access

all

Temporarily limit administrator accounts to only essential personnel

🧯 If You Can't Patch

  • Implement strict network segmentation to isolate WordPress installation
  • Enable comprehensive SQL query logging and monitoring for injection patterns

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Colibri Page Builder version. If version is 1.0.227 or lower, you are vulnerable.

Check Version:

wp plugin get colibri-page-builder --field=version

Verify Fix Applied:

Verify plugin version is 1.0.228 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

  • Unusual SQL queries in WordPress/database logs
  • Multiple failed login attempts followed by administrator access
  • Unusual database queries containing UNION SELECT or other injection patterns

Network Indicators:

  • Unusual outbound database connections from WordPress server
  • Large data transfers from WordPress database

SIEM Query:

source="wordpress.log" AND ("post_id" AND ("UNION" OR "SELECT *" OR "information_schema"))

📊 Metadata

CVE ID: CVE-2023-2188
CVSS v3 Score: 7.2 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: August 31, 2023
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON