CVE-2023-28662
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary SQL commands on WordPress sites using the Gift Cards plugin version 4.3.1 or earlier. It can lead to data theft, modification, or deletion, affecting all sites with the vulnerable plugin installed.
💻 Affected Systems
- Gift Cards (Gift Vouchers and Packages) WordPress Plugin
📦 What is this software?
Gift Vouchers by Codemenschen
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the WordPress database, including sensitive data exfiltration, site defacement, or remote code execution via database functions.
Likely Case
Unauthorized access to or manipulation of database contents, such as user credentials, payment information, or gift card data.
If Mitigated
Limited impact if SQL injection protections like input sanitization or web application firewalls are in place, but risk remains high without patching.
🎯 Exploit Status
Exploitation is straightforward via crafted HTTP requests to the vulnerable endpoint, as detailed in public references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 4.3.1
Vendor Advisory: https://wordpress.org/plugins/gift-voucher/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Gift Cards (Gift Vouchers and Packages)' and update to the latest version. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Disable the vulnerable plugin
allTemporarily deactivate the plugin to prevent exploitation until patching is possible.
wp plugin deactivate gift-voucher
Implement WAF rules
allAdd web application firewall rules to block SQL injection attempts targeting the wpgv_doajax_voucher_pdf_save_func action.
🧯 If You Can't Patch
- Restrict access to the WordPress admin and vulnerable endpoints using IP whitelisting or authentication.
- Monitor logs for unusual SQL queries or requests to the affected plugin and implement intrusion detection.
🔍 How to Verify
Check if Vulnerable:
Check the plugin version in WordPress admin under Plugins > Installed Plugins; if version is 4.3.1 or lower, it is vulnerable.Check Version:
wp plugin get gift-voucher --field=versionVerify Fix Applied:
After updating, confirm the plugin version is above 4.3.1 and test the vulnerable endpoint with safe payloads to ensure no SQL injection occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with action=wpgv_doajax_voucher_pdf_save_func and SQL-like parameters in logs.
Network Indicators:
- HTTP traffic containing SQL injection patterns (e.g., UNION, SELECT) directed at the plugin's AJAX endpoint.
SIEM Query:
source="wordpress.log" AND uri="/wp-admin/admin-ajax.php" AND (param="template" AND value CONTAINS "' OR '1'='1")