CVE-2023-7293
📋 TL;DR
This vulnerability in the Paytium WordPress plugin allows authenticated attackers with subscriber-level access to verify the existence of a Mollie payment account. It affects WordPress sites using Paytium versions up to 4.3.7. The issue stems from missing capability checks in the check_mollie_account_details function.
💻 Affected Systems
- Paytium: Mollie payment forms & donations plugin for WordPress
📦 What is this software?
Paytium by Paytium
⚠️ Risk & Real-World Impact
Worst Case
Attackers could confirm active Mollie accounts, potentially enabling targeted phishing or reconnaissance for further attacks against payment infrastructure.
Likely Case
Information disclosure allowing attackers to verify payment account existence, which could be used for social engineering or targeted attacks.
If Mitigated
Minimal impact if proper access controls and monitoring are in place, as this only reveals account existence, not sensitive data.
🎯 Exploit Status
Exploitation requires authenticated access with subscriber privileges. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.8
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Paytium plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 4.3.8+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Remove vulnerable plugin
linuxTemporarily disable or remove Paytium plugin until patched
wp plugin deactivate paytium
wp plugin delete paytium
Restrict user roles
allLimit subscriber-level access or implement additional access controls
🧯 If You Can't Patch
- Implement network segmentation to isolate WordPress installation
- Enhance monitoring for suspicious API calls to check_mollie_account_details function
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Paytium version. If version is 4.3.7 or lower, system is vulnerable.Check Version:
wp plugin get paytium --field=versionVerify Fix Applied:
Confirm Paytium plugin version is 4.3.8 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to check_mollie_account_details from subscriber accounts
- Multiple failed authentication attempts followed by successful subscriber login
Network Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php with action=check_mollie_account_details
SIEM Query:
source="wordpress_logs" AND (uri_path="/wp-admin/admin-ajax.php" AND parameters.action="check_mollie_account_details")