CVE-2023-7289
📋 TL;DR
This vulnerability allows authenticated WordPress users with subscriber-level permissions to change the Paytium plugin's API keys without authorization. This affects WordPress sites using Paytium: Mollie payment forms & donations plugin versions up to 4.3.7. Attackers could redirect payments or disrupt payment processing functionality.
💻 Affected Systems
- Paytium: Mollie payment forms & donations plugin for WordPress
📦 What is this software?
Paytium by Paytium
⚠️ Risk & Real-World Impact
Worst Case
Attackers redirect payment transactions to their own accounts, steal funds, and compromise payment data integrity.
Likely Case
Payment processing disruption, unauthorized transaction redirection, and potential financial loss.
If Mitigated
Limited impact with proper access controls, monitoring, and API key validation in place.
🎯 Exploit Status
Requires authenticated access but only subscriber-level permissions. Simple HTTP request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.8
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find Paytium plugin. 4. Click 'Update Now' or manually update to version 4.3.8+. 5. Verify update completes successfully.
🔧 Temporary Workarounds
Remove Subscriber Access
allTemporarily disable or remove subscriber-level user accounts until patching.
wp user delete <username> --yes
wp user update <username> --role=no_role
Restrict API Endpoint
linuxUse web application firewall or .htaccess to block access to vulnerable endpoint.
# Add to .htaccess:
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$
RewriteCond %{QUERY_STRING} action=paytium_sw_save_api_keys
RewriteRule ^ - [F]
🧯 If You Can't Patch
- Implement strict user role management and review all subscriber accounts
- Enable detailed logging of API key changes and monitor for unauthorized modifications
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Paytium plugin version. If version is 4.3.7 or lower, system is vulnerable.Check Version:
wp plugin list --name=paytium --field=versionVerify Fix Applied:
Verify Paytium plugin version is 4.3.8 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST requests to /wp-admin/admin-ajax.php with action=paytium_sw_save_api_keys
- Unexpected API key changes in plugin logs
Network Indicators:
- HTTP POST requests to admin-ajax.php with API key parameters from non-admin users
SIEM Query:
source="wordpress.log" AND "paytium_sw_save_api_keys" AND user_role="subscriber"