CVE-2023-32960
📋 TL;DR
This CSRF vulnerability in UpdraftPlus WordPress Backup Plugin allows attackers to trick authenticated administrators into executing malicious actions. When exploited, it can lead to site-wide XSS attacks affecting all users who visit the compromised WordPress admin area. WordPress sites running vulnerable UpdraftPlus versions are affected.
💻 Affected Systems
- UpdraftPlus WordPress Backup Plugin
📦 What is this software?
Updraftplus by Updraftplus
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full control of WordPress site through admin session hijacking, injects malicious scripts affecting all visitors, and potentially compromises server infrastructure.
Likely Case
Attacker injects malicious JavaScript into WordPress admin area, stealing admin credentials or redirecting users to malicious sites.
If Mitigated
Limited impact with proper CSRF protections and admin awareness; potential for minor script injection but contained by security plugins.
🎯 Exploit Status
Exploitation requires tricking authenticated admin to click malicious link; CSRF to XSS chain is well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.23.4
Vendor Advisory: https://updraftplus.com/updraftplus-security-release-1-23-4/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find UpdraftPlus and click 'Update Now'. 4. Verify version shows 1.23.4 or higher.
🔧 Temporary Workarounds
Temporary CSRF Protection
allInstall WordPress security plugin with CSRF protection like Wordfence or iThemes Security
Admin Session Protection
allImplement strict admin session management and logout idle sessions
🧯 If You Can't Patch
- Disable UpdraftPlus plugin temporarily and use alternative backup solution
- Implement web application firewall (WAF) rules to block CSRF attempts targeting UpdraftPlus endpoints
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins > UpdraftPlus versionCheck Version:
wp plugin list --name=updraftplus --field=versionVerify Fix Applied:
Confirm UpdraftPlus version is 1.23.4 or higher in WordPress plugins list📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with updraftplus actions
- Multiple failed CSRF token validations in security plugin logs
Network Indicators:
- HTTP requests with suspicious referer headers targeting UpdraftPlus endpoints
- Unusual traffic patterns to /wp-admin/admin-ajax.php
SIEM Query:
source="wordpress.logs" AND (uri_path="/wp-admin/admin-ajax.php" AND action="updraftplus_*")🔗 References
- https://patchstack.com/database/vulnerability/updraftplus/wordpress-updraftplus-plugin-1-23-3-csrf-lead-to-wp-admin-site-wide-xss-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/updraftplus/wordpress-updraftplus-plugin-1-23-3-csrf-lead-to-wp-admin-site-wide-xss-vulnerability?_s_id=cve
