CVE-2023-23671
📋 TL;DR
This CSRF vulnerability in the Muneeb Layer Slider WordPress plugin allows attackers to trick authenticated administrators into performing unauthorized actions. Attackers can create malicious web pages that, when visited by logged-in administrators, can delete posts or pages without their consent. WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Muneeb Layer Slider WordPress Plugin
📦 What is this software?
Layer Slider by Web Settler
⚠️ Risk & Real-World Impact
Worst Case
Complete website defacement or destruction through mass deletion of posts, pages, and content, potentially requiring full restoration from backups.
Likely Case
Targeted deletion of specific posts or pages by attackers who craft malicious links sent to administrators via phishing.
If Mitigated
No impact if proper CSRF tokens are implemented or administrators don't visit malicious sites while authenticated.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated administrators into visiting malicious pages. CSRF attacks are well-understood and easy to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.9.8 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Layer Slider' plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download latest version from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate slider-slideshow
Implement CSRF Protection
allAdd custom CSRF tokens to plugin forms via custom code
🧯 If You Can't Patch
- Restrict administrator access to trusted networks only
- Implement strict Content Security Policy (CSP) headers to prevent cross-origin requests
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Layer Slider version numberCheck Version:
wp plugin get slider-slideshow --field=versionVerify Fix Applied:
Verify plugin version is 1.1.9.8 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with delete actions
- Multiple page/post deletions in short timeframes from same admin user
Network Indicators:
- Cross-origin requests to WordPress admin endpoints from unexpected domains
SIEM Query:
source="wordpress.log" AND (action="delete_post" OR action="trash_post") AND referer NOT CONTAINS "yourdomain.com"🔗 References
- https://patchstack.com/database/vulnerability/slider-slideshow/wordpress-layer-slider-plugin-1-1-9-6-cross-site-request-forgery-csrf-leading-to-post-page-deletion-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/slider-slideshow/wordpress-layer-slider-plugin-1-1-9-6-cross-site-request-forgery-csrf-leading-to-post-page-deletion-vulnerability?_s_id=cve
