CVE-2023-23672
📋 TL;DR
CVE-2023-23672 is a missing authorization vulnerability in the GiveWP WordPress plugin that allows authenticated users to delete arbitrary content without proper permissions. This affects WordPress sites running GiveWP versions up to 2.25.1. The vulnerability enables privilege escalation through unauthorized content manipulation.
💻 Affected Systems
- WordPress GiveWP Plugin
📦 What is this software?
Givewp by Givewp
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could delete critical website content, donation records, or configuration data, potentially causing data loss, service disruption, or financial impact.
Likely Case
Malicious users with basic accounts could delete donation forms, content pages, or plugin data, disrupting fundraising operations and website functionality.
If Mitigated
With proper access controls and monitoring, impact would be limited to unauthorized content deletion within the plugin's scope, with audit trails for investigation.
🎯 Exploit Status
Exploitation requires authenticated access. Public proof-of-concept demonstrates content deletion via API endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.25.2 and later
Vendor Advisory: https://wordpress.org/plugins/give/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find GiveWP and click 'Update Now'. 4. Verify update to version 2.25.2 or higher.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable GiveWP plugin until patched version can be installed
wp plugin deactivate give
Restrict User Registration
allTemporarily disable new user registration to limit attack surface
wp option update users_can_register 0
🧯 If You Can't Patch
- Implement strict user role management and review all authenticated user permissions
- Enable comprehensive logging and monitoring of content deletion actions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > GiveWP version. If version is 2.25.1 or lower, system is vulnerable.Check Version:
wp plugin list --name=give --field=versionVerify Fix Applied:
Verify GiveWP plugin version is 2.25.2 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual content deletion events in WordPress logs
- Multiple DELETE requests to GiveWP API endpoints from non-admin users
Network Indicators:
- HTTP DELETE requests to /wp-json/give/v2/* endpoints from unauthorized IPs
SIEM Query:
source="wordpress.log" AND ("DELETE" AND "give/v2") AND NOT user_role="administrator"