PT-2023-17638 · WordPress · Buy Me A Coffee – Button/Widget Plugin

István Márton + 1 · Published 2023-07-11 · Updated 2023-07-18 · CVE-2023-2079

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Buy Me a Coffee – Button and Widget Plugin versions up to, and including, 3.7

Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the recieve post, bmc disconnect, name post, and widget post functions. This allows unauthenticated attackers to update the plugin's settings by tricking a site's administrator into performing an action, such as clicking on a link, via a forged request.

Recommendations For versions up to, and including, 3.7, consider disabling the recieve post, bmc disconnect, name post, and widget post functions until a patch is available to prevent exploitation. Restrict access to the plugin's settings to minimize the risk of unauthorized updates. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-2079

Affected Products

Buy Me A Coffee – Button/Widget Plugin

References · 7

• 🔥 https://plugins.trac.wordpress.org/browser/buymeacoffee/trunk/includes/class-buy-me-a-coffee.php?rev=2319979#L162 · Exploit
• 🔥 https://plugins.trac.wordpress.org/browser/buymeacoffee/trunk/admin/class-buy-me-a-coffee-admin.php?rev=2816542 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2079 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2935565%40buymeacoffee&new=2935565%40buymeacoffee&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2023-2079 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/6309258e-e4fc-4edf-a771-2d82a9a85a5c?source=cve · Note
• https://t.me/cvenotify/54042 · Telegram Post