CVE-2023-5957
📋 TL;DR
This vulnerability allows high-privileged WordPress users (like administrators) to upload arbitrary files including web shells to the server through the Ni Purchase Order plugin's logo/signature upload feature. This leads to remote code execution (RCE) on affected WordPress sites. Only sites using the vulnerable plugin versions are affected.
💻 Affected Systems
- Ni Purchase Order(PO) For WooCommerce WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary code, steal data, install malware, or pivot to other systems.
Likely Case
Attackers upload web shells to gain persistent access, deface websites, or deploy cryptocurrency miners.
If Mitigated
No impact if proper file upload validation and user privilege controls are implemented.
🎯 Exploit Status
Exploitation requires administrator or high-privileged user credentials. Attack involves uploading malicious PHP files disguised as images.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.2 or later
Vendor Advisory: https://wpscan.com/vulnerability/70f823ff-64ad-4f05-9eb3-b69b3b79dc12
Restart Required: No
Instructions:
1. Update Ni Purchase Order plugin to version 1.2.2 or higher via WordPress admin panel. 2. Verify update completed successfully. 3. Test plugin functionality.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate ni-purchase-order-for-woocommerce
Restrict file uploads
linuxAdd server-side restrictions on uploadable file types
Add to .htaccess: <FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps|php-s|pht|phar)$">
Order Allow,Deny
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Remove administrator access from untrusted users
- Implement web application firewall (WAF) rules to block malicious file uploads
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Ni Purchase Order for WooCommerce. If version is 1.2.1 or lower, you are vulnerable.Check Version:
wp plugin get ni-purchase-order-for-woocommerce --field=versionVerify Fix Applied:
Verify plugin version is 1.2.2 or higher in WordPress admin panel. Test logo/signature upload functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to wp-content/uploads/ni-purchase-order/ directory
- PHP file execution from unexpected locations
- Administrator account login anomalies
Network Indicators:
- POST requests to /wp-admin/admin.php?page=ni-purchase-order with file uploads
- Unusual outbound connections from web server
SIEM Query:
source="web_server" AND (uri="/wp-admin/admin.php" AND query="page=ni-purchase-order" AND method="POST")