CVE-2023-4404
📋 TL;DR
The Donation Forms by Charitable WordPress plugin allows unauthenticated attackers to escalate privileges by specifying their user role during registration. This vulnerability affects all WordPress sites using Charitable plugin versions up to 1.7.0.12, enabling attackers to gain administrative access without authentication.
💻 Affected Systems
- Donation Forms by Charitable WordPress plugin
📦 What is this software?
Charitable by Wpcharitable
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control over WordPress sites, allowing them to install backdoors, steal data, deface websites, or use the site for further attacks.
Likely Case
Attackers create administrator accounts and take control of vulnerable WordPress installations, often leading to malware injection, data theft, or site takeover.
If Mitigated
With proper web application firewalls and monitoring, exploitation attempts are blocked and detected before successful compromise.
🎯 Exploit Status
Exploitation requires only HTTP POST requests with the 'role' parameter set to administrator or other privileged roles.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0.13 and later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2976818/charitable/trunk/includes/users/class-charitable-user.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Donation Forms by Charitable'
4. Click 'Update Now' or manually update to version 1.7.0.13+
5. Verify update completes successfully
🔧 Temporary Workarounds
Disable Charitable Plugin
linuxTemporarily disable the vulnerable plugin until patching is possible
wp plugin deactivate charitable
Web Application Firewall Rule
allBlock requests containing the 'role' parameter in registration endpoints
🧯 If You Can't Patch
- Disable user registration functionality in WordPress settings
- Implement IP-based access restrictions to registration endpoints
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Charitable version ≤1.7.0.12Check Version:
wp plugin get charitable --field=versionVerify Fix Applied:
Verify Charitable plugin version is 1.7.0.13 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php with 'action=charitable_update_core_user' and 'role' parameter
- Unusual user registration events with administrator roles
- Multiple failed login attempts followed by successful registration
Network Indicators:
- POST requests containing 'role=administrator' or similar privileged roles
- Traffic to registration endpoints from suspicious IPs
SIEM Query:
source="web_logs" AND (uri_path="/wp-admin/admin-ajax.php" AND method="POST" AND params CONTAINS "role=" AND params CONTAINS "charitable_update_core_user")🔗 References
- https://plugins.trac.wordpress.org/browser/charitable/tags/1.7.0.12/includes/users/class-charitable-user.php#L866
- https://www.wordfence.com/threat-intel/vulnerabilities/id/522ecc1c-5834-4325-9234-79cf712213f3?source=cve
- https://plugins.trac.wordpress.org/browser/charitable/tags/1.7.0.12/includes/users/class-charitable-user.php#L866
- https://www.wordfence.com/threat-intel/vulnerabilities/id/522ecc1c-5834-4325-9234-79cf712213f3?source=cve
