CVE-2023-5974
📋 TL;DR
The WPB Show Core WordPress plugin through version 2.2 contains a server-side request forgery (SSRF) vulnerability in the 'path' parameter. This allows attackers to make unauthorized requests from the vulnerable server to internal or external systems. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- WPB Show Core WordPress Plugin
📦 What is this software?
Wpb Show Core by Wpb Show Core Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, perform port scanning of internal networks, or chain with other vulnerabilities to achieve remote code execution.
Likely Case
Attackers scanning for internal services, accessing metadata services (like AWS IMDS), or making requests to internal APIs to gather information.
If Mitigated
Limited impact with proper network segmentation, outbound firewall rules, and input validation in place.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited and weaponized due to their potential for internal network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.3 or later
Vendor Advisory: https://wpscan.com/vulnerability/c0136057-f420-4fe7-a147-ecbec7e7a9b5
Restart Required: No
Instructions:
1. Update WPB Show Core plugin to version 2.3 or later via WordPress admin panel. 2. Verify update completed successfully. 3. Test plugin functionality after update.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the WPB Show Core plugin until patched
wp plugin deactivate wpb-show-core
Web Application Firewall rule
allBlock requests containing SSRF patterns in the path parameter
🧯 If You Can't Patch
- Implement strict outbound firewall rules to limit server-initiated connections
- Deploy network segmentation to isolate WordPress server from sensitive internal systems
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > WPB Show Core version. If version is 2.2 or lower, you are vulnerable.Check Version:
wp plugin get wpb-show-core --field=versionVerify Fix Applied:
After updating, verify plugin version shows 2.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from WordPress server
- Requests to internal IP addresses or metadata services
- Multiple failed connection attempts to various ports
Network Indicators:
- WordPress server making unexpected outbound HTTP/HTTPS requests
- Requests to internal network ranges from web server
SIEM Query:
source="wordpress.log" AND ("wpb-show-core" OR "path parameter") AND (http_request OR outbound_connection)