CVE-2023-36684
📋 TL;DR
This CVE describes a missing authorization vulnerability in the WordPress Convert Pro plugin that allows unauthorized users to access administrative functions. It affects all WordPress sites running Convert Pro versions up to 1.7.5. Attackers can exploit this to modify plugin settings or potentially gain elevated privileges.
💻 Affected Systems
- WordPress Convert Pro plugin
📦 What is this software?
Convert Pro by Brainstormforce
⚠️ Risk & Real-World Impact
Worst Case
Complete site compromise through privilege escalation to administrator, allowing content modification, plugin/theme installation, or data exfiltration.
Likely Case
Unauthorized modification of Convert Pro settings, popup configurations, or lead capture forms, potentially enabling phishing or data collection.
If Mitigated
No impact if proper authorization checks are implemented and only authenticated administrators can access plugin functions.
🎯 Exploit Status
Exploitation requires some WordPress user access but not administrative privileges. Attack patterns are well-known for WordPress authorization bypass vulnerabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.6 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/convertpro/wordpress-convert-pro-plugin-1-7-5-broken-access-control-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Convert Pro and click 'Update Now'. 4. Verify version is 1.7.6 or higher.
🔧 Temporary Workarounds
Disable Convert Pro plugin
allTemporarily deactivate the vulnerable plugin until patched
wp plugin deactivate convertpro
Restrict plugin access via .htaccess
linuxAdd IP-based restrictions to plugin admin pages
# Add to .htaccess in wp-content/plugins/convertpro/
Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block unauthorized access to /wp-admin/admin.php?page=convertpro* endpoints
- Enable WordPress security plugins that monitor for authorization bypass attempts and restrict user capabilities
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > Installed Plugins for Convert Pro version. If version is 1.7.5 or lower, system is vulnerable.Check Version:
wp plugin get convertpro --field=versionVerify Fix Applied:
Verify Convert Pro version is 1.7.6 or higher in WordPress admin panel. Test administrative functions require proper authentication.📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST requests to /wp-admin/admin.php?page=convertpro* from non-admin users
- Multiple 403 errors followed by 200 success codes for same endpoint
Network Indicators:
- Unusual traffic patterns to WordPress admin endpoints from unexpected IPs
- POST requests to convertpro endpoints without proper authentication headers
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-admin/admin.php" AND query_string="*page=convertpro*") AND user_role!="administrator" AND response_code=200