CVE-2023-35041 – This vulnerability allows attackers to trick au... (How to Fix)

Q: How do I fix CVE-2023-35041?

1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find Webpushr Web Push Notifications. 4. Click Update Now to version 4.35.0 or higher.

Q: What is the severity of CVE-2023-35041?

CVE-2023-35041 has a CVSS score of 8.8 (HIGH). This vulnerability allows attackers to trick authenticated WordPress administrators into performing unintended actions via Cross-Site Request Forgery (CSRF), leading to Local File Inclusion (LFI). Attackers can read sensitive files from the server. Affects WordPress sites using the Webpushr Web Push Notifications plugin.

📋 TL;DR

This vulnerability allows attackers to trick authenticated WordPress administrators into performing unintended actions via Cross-Site Request Forgery (CSRF), leading to Local File Inclusion (LFI). Attackers can read sensitive files from the server. Affects WordPress sites using the Webpushr Web Push Notifications plugin.

💻 Affected Systems

Products:

Webpushr Web Push Notifications WordPress plugin

Versions: <= 4.34.0

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress administrator to be tricked into visiting malicious page while authenticated.

📦 What is this software?

Web Push Notifications by Webpushr

View all CVEs affecting Web Push Notifications →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise through LFI leading to remote code execution, sensitive data exposure, and website defacement.

🟠

Likely Case

Unauthorized file reading including configuration files, sensitive data exposure, and potential privilege escalation.

🟢

If Mitigated

Limited impact with proper CSRF protections and file permission restrictions in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires social engineering to trick authenticated admin, but technical complexity is low.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.35.0

Vendor Advisory: https://patchstack.com/database/vulnerability/webpushr-web-push-notifications/wordpress-web-push-notifications-webpushr-plugin-4-34-0-csrf-leading-to-lfi-vulnerability

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find Webpushr Web Push Notifications. 4. Click Update Now to version 4.35.0 or higher.

🔧 Temporary Workarounds

Disable plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate webpushr-web-push-notifications

Add CSRF protection headers

all

Implement additional CSRF protection at web server level

🧯 If You Can't Patch

Restrict file system permissions to prevent LFI exploitation
Implement strict Content Security Policy (CSP) headers

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Webpushr Web Push Notifications version

Check Version:

wp plugin get webpushr-web-push-notifications --field=version

Verify Fix Applied:

Verify plugin version is 4.35.0 or higher in WordPress admin

📡 Detection & Monitoring

Log Indicators:

Unusual file access patterns in web server logs
CSRF token validation failures

Network Indicators:

Unexpected file inclusion requests to plugin endpoints

SIEM Query:

source="web_server" AND (uri="*webpushr*" AND uri="*file*" OR uri="*include*")

📊 Metadata

CVE ID: CVE-2023-35041

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-352

Published: November 13, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-35041, you might also want to check these: