CVE-2023-22677
📋 TL;DR
CVE-2023-22677 is a code injection vulnerability in the WordPress WP Booklet plugin that allows remote attackers to execute arbitrary code on affected systems. This affects all WordPress sites running WP Booklet versions up to 2.1.8. Attackers can potentially take full control of vulnerable websites.
💻 Affected Systems
- WordPress WP Booklet plugin
📦 What is this software?
Wp Booklet by Binarystash
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the WordPress installation leading to data theft, defacement, malware distribution, or use as a foothold for lateral movement in the network.
Likely Case
Remote code execution leading to website takeover, data exfiltration, or installation of backdoors and malware.
If Mitigated
Limited impact if proper web application firewalls and input validation are in place, though the vulnerability remains exploitable.
🎯 Exploit Status
Exploitation requires no authentication and has been weaponized in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.9 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/wp-booklet/wordpress-wp-booklet-plugin-2-1-8-remote-code-execution-rce
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Booklet and update to version 2.1.9 or later. 4. If update not available, deactivate and delete the plugin immediately.
🔧 Temporary Workarounds
Disable WP Booklet plugin
allTemporarily disable the vulnerable plugin until patched version is available
wp plugin deactivate wp-booklet
Web Application Firewall rule
allBlock requests to wp-booklet endpoints
Add WAF rule to block /wp-content/plugins/wp-booklet/*
🧯 If You Can't Patch
- Immediately deactivate and remove the WP Booklet plugin from all WordPress installations
- Implement strict input validation and output encoding for all user-controlled data
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WP Booklet version 2.1.8 or earlierCheck Version:
wp plugin list --name=wp-booklet --field=versionVerify Fix Applied:
Verify WP Booklet plugin version is 2.1.9 or later in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-content/plugins/wp-booklet/
- PHP execution errors in web server logs
- Unauthorized file uploads or modifications
Network Indicators:
- HTTP requests containing suspicious payloads to wp-booklet endpoints
- Unexpected outbound connections from web server
SIEM Query:
source="web_server" AND (uri="*wp-booklet*" AND (method="POST" OR method="PUT"))